use user object in auth now