nominally working web api
user auth call to verify access token and return user object
move access token check to perfect_common