always ghost user (we assume that the new login has a reason)