user object attached to response