Are you sure `user._id` is defined here?