hot fix: allow user to signin if /auth/user returns 401