don't leak the user object