set user to nil for logged out