refactoring protected variable. now it's `$_user` instead `$user`