Fixing bug that surfaced only now: 'user' object is available only after successful validate(); maybe new version of flask_security