user available only after default_auth_store is set