erroneously relying on key() to determine which user we are operating on