apply expansions to user deserialization

Apply the same expansion to `deserializeUser()` as in the `authenticate()` call.


I see Github's editor also added a newline at EOF.