Guard against passed in nil user on sign_in

`sign_in` gets called, passing in `user` straight from the client code,
and can result in `user` being `nil`.
Add regression test