updating to allow for code validation without fetching the user