Shouldn't we send a 404 if no user is found?