auth: create user object regardless of login