convert additional security context to userManager
add check that $user is an object

otherwise, likely to be anonymous
remove used use statements
remove yet another security context reference