'user' can also legally be None I guess