is this here not just $app['security.user_provider'] rather? i may be wrong though