user must be obtain from acl_users