Do we always want to 404 if we can't find a user? Seems more natural to return None or a sentinal NO_SUCH_USER kind of value rather than force an abort here.