auth: Always return a user object and pass it down to op slot service