don't allow user to be set via form in SignedIn.