Authenticate endpoint now has a content-location header to point to the user record