minor nitpick, but why are you using `_request.user` here when `user` should be the same thing?