change .user to return the authenticated user when no username is passed