Confusing naming again.  Why did the user become `application` here?  Why not send it as `application` on req?