this is bad we should use `toolkit.c.user` to be sure it is the actual user logged in