if user is false, it means the auth failed.  should not continue then

this was causing the issue reported in #59 and probably other errors caused by failure to detect that authorization had failed.