could `response.user` ever be `undefined`?