need this to be after the `eamap.user = login_user`, since the enrollment authorization check will need an updated eamap