No need to inject the security context: ``$user = $form->getData()`` is the listener