missing r.Body.Close() in user.go