We do stop processing when there isn't an SSA token when there should be... and we shouldn't throw an error if `_user` isn't provided, like I mentioned above.