App user always merged from auth user.