Fix update to retrieve user from url not from request