user set from OAuth request is request.resource_owner, not request.user