in the OAuth flow, users should be validated if they belong to the fellowship JSON file at /data/ already contains users list