api: make sure userObj is fresh between calls, since many of them will
be chained and will modify user spec
return 400 if NO_USER_FOUND unecessary since handled in auth
pass in cron user as object, otherwise we're modifying a different user object