Small fix in User model
Add TODO to policy
Inject status in response json
Replace auth with cipher service
Update changelog