diff --git a/backend/go.mod b/backend/go.mod
index 10671ec8..312c07f9 100644
--- a/backend/go.mod
+++ b/backend/go.mod
@@ -12,7 +12,7 @@ require (
 	github.com/go-chi/chi/v5 v5.0.5
 	github.com/go-chi/cors v1.2.0
 	github.com/go-chi/render v1.0.1
-	github.com/go-pkgz/auth v1.18.1-0.20211107180414-66d9ca410559
+	github.com/go-pkgz/auth v1.18.1-0.20211207184750-78e5d290333d
 	github.com/go-pkgz/jrpc v0.2.0
 	github.com/go-pkgz/lcw v0.8.1
 	github.com/go-pkgz/lgr v0.10.4
diff --git a/backend/go.sum b/backend/go.sum
index 010c4c04..55d0b0dc 100644
--- a/backend/go.sum
+++ b/backend/go.sum
@@ -129,6 +129,8 @@ github.com/go-pkgz/auth v1.18.0 h1:H+C/VZ/qZqDpqJfS7lwuF89OnMIcZINXwFAuEfTSQTA=
 github.com/go-pkgz/auth v1.18.0/go.mod h1:hfGyJXugY0O9IPKYHBzf6pDozWtqYMMkI8iSc0kPd14=
 github.com/go-pkgz/auth v1.18.1-0.20211107180414-66d9ca410559 h1:gLKBYPqUmaIogVkzvQclW6/qz08pdvcx7DVBxF+XLS8=
 github.com/go-pkgz/auth v1.18.1-0.20211107180414-66d9ca410559/go.mod h1:N1VM53c22Uw0UQSYgdTOBK1D2vtPjSc/RWGf/Fhc1y8=
+github.com/go-pkgz/auth v1.18.1-0.20211207184750-78e5d290333d h1:ClnnpQqTp84SIq8NNnqDW7SpZ5b5nwdlQN3Yq7vglW8=
+github.com/go-pkgz/auth v1.18.1-0.20211207184750-78e5d290333d/go.mod h1:N1VM53c22Uw0UQSYgdTOBK1D2vtPjSc/RWGf/Fhc1y8=
 github.com/go-pkgz/expirable-cache v0.0.3 h1:rTh6qNPp78z0bQE6HDhXBHUwqnV9i09Vm6dksJLXQDc=
 github.com/go-pkgz/expirable-cache v0.0.3/go.mod h1:+IauqN00R2FqNRLCLA+X5YljQJrwB179PfiAoMPlTlQ=
 github.com/go-pkgz/jrpc v0.2.0 h1:CLy/eZyekjraVrxZV18N2R1mYLMJ/nWrgdfyIOGPY/E=
diff --git a/backend/vendor/github.com/go-pkgz/auth/README.md b/backend/vendor/github.com/go-pkgz/auth/README.md
index b2904052..b237491a 100644
--- a/backend/vendor/github.com/go-pkgz/auth/README.md
+++ b/backend/vendor/github.com/go-pkgz/auth/README.md
@@ -101,6 +101,7 @@ For the example above authentication handlers wired as `/auth` and provides:
 - `/auth/<provider>/logout` and `/auth/logout` - invalidate "session" by removing JWT cookie
 - `/auth/list` - gives a json list of active providers
 - `/auth/user` - returns `token.User` (json)
+- `/auth/status` - returns status of logged in user (json)
 
 ### User info
 
@@ -383,6 +384,22 @@ It will run fake aouth2 "server" on port :8084 and user could login with any use
 
 _Warning: this is not the real oauth2 server but just a small fake thing for development and testing only. Don't use `dev` provider with any production code._
 
+By default, Dev provider doesn't return `email` claim from `/user` endpoint, to match behaviour of other providers which only request minimal scopes.
+However sometimes it is useful to have `email` included into user info. This can be done by configuring `devAuthServer.GetEmailFn` function:
+
+```go
+    go func() {
+		devAuthServer, err := service.DevAuth()
+		devOauth2Srv.GetEmailFn = func(username string) string {
+			return username + "@example.com"
+		}
+		if err != nil {
+			log.Fatal(err)
+		}
+		devAuthServer.Run()
+	}()
+```
+
 ### Other ways to authenticate
 
 In addition to the primary method (i.e. JWT cookie with XSRF header) there are two more ways to authenticate:
diff --git a/backend/vendor/github.com/go-pkgz/auth/auth.go b/backend/vendor/github.com/go-pkgz/auth/auth.go
index ba5836b4..d1391600 100644
--- a/backend/vendor/github.com/go-pkgz/auth/auth.go
+++ b/backend/vendor/github.com/go-pkgz/auth/auth.go
@@ -189,6 +189,17 @@ func (s *Service) Handlers() (authHandler, avatarHandler http.Handler) {
 			return
 		}
 
+		// status of logged in user
+		if elems[len(elems)-1] == "status" {
+			claims, _, err := s.jwtService.Get(r)
+			if err != nil {
+				rest.RenderJSON(w, rest.JSON{"status": "not logged in"})
+				return
+			}
+			rest.RenderJSON(w, rest.JSON{"status": "logged in", "user": claims.User.Name})
+			return
+		}
+
 		// regular auth handlers
 		provName := elems[len(elems)-2]
 		p, err := s.Provider(provName)
diff --git a/backend/vendor/github.com/go-pkgz/auth/provider/dev_provider.go b/backend/vendor/github.com/go-pkgz/auth/provider/dev_provider.go
index e76ec33b..58049ded 100644
--- a/backend/vendor/github.com/go-pkgz/auth/provider/dev_provider.go
+++ b/backend/vendor/github.com/go-pkgz/auth/provider/dev_provider.go
@@ -25,10 +25,11 @@ const defDevAuthPort = 8084
 // desired user name, this is the mode used for development. Non-interactive mode for tests only.
 type DevAuthServer struct {
 	logger.L
-	Provider  Oauth2Handler
-	Automatic bool
-	username  string // unsafe, but fine for dev
+	Provider   Oauth2Handler
+	Automatic  bool
+	GetEmailFn func(string) string
 
+	username   string // unsafe, but fine for dev
 	httpServer *http.Server
 	lock       sync.Mutex
 }
@@ -101,6 +102,16 @@ func (d *DevAuthServer) Run(ctx context.Context) { //nolint (gocyclo)
 					"picture":"%s"
 					}`, d.username, d.username, ava)
 
+				if d.GetEmailFn != nil {
+					email := d.GetEmailFn(d.username)
+					res = fmt.Sprintf(`{
+					"id": "%s",
+					"name":"%s",
+					"picture":"%s",
+					"email": "%s"
+					}`, d.username, d.username, ava, email)
+				}
+
 				w.Header().Set("Content-Type", "application/json; charset=utf-8")
 				if _, err = w.Write([]byte(res)); err != nil {
 					w.WriteHeader(http.StatusInternalServerError)
@@ -169,6 +180,7 @@ func NewDev(p Params) Oauth2Handler {
 				ID:      data.Value("id"),
 				Name:    data.Value("name"),
 				Picture: data.Value("picture"),
+				Email:   data.Value("email"),
 			}
 			return userInfo
 		},
diff --git a/backend/vendor/modules.txt b/backend/vendor/modules.txt
index 631cdc86..3bf5a987 100644
--- a/backend/vendor/modules.txt
+++ b/backend/vendor/modules.txt
@@ -76,7 +76,7 @@ github.com/go-chi/cors
 # github.com/go-chi/render v1.0.1
 ## explicit
 github.com/go-chi/render
-# github.com/go-pkgz/auth v1.18.1-0.20211107180414-66d9ca410559
+# github.com/go-pkgz/auth v1.18.1-0.20211207184750-78e5d290333d
 ## explicit
 github.com/go-pkgz/auth
 github.com/go-pkgz/auth/avatar