update user

if user isn’t in db
server will callback valid: false