This is needed because the Provider instance sometimes doesn't have a user on "access()". Credentials should probably be sufficient in this case.
Is the `user` check required at all?