apply expansions to user deserialization

Apply the same expansion to `deserializeUser()` as in the `authenticate()` call.