ah this works because the `app_user` return value is not used below.