allow empty user query, check for null user on auth