_user is now always actual user (not "as" user)