Think it's necessary to pass the user object in since the Authority instance will contain a reference and accessor to that object?