Unsafe cast to User

I've noticed that in packages/pn-pa-webapp/src/api/auth/Auth.api.ts the payload returned by the backend gets cast to the `User` type, this is usually unsafe as there's no guarantee the payload is consistent with the type.