if user does NOT exist, corrected. Removing scoped_lock, function supposed to be called holding lock if dev wants to be safe.