In get_user, should be signed hash

The hash included in the user record should be signed, not the raw hash.