in combination with the change above this definitely does at least one unnecessary DB request - could refactor to get the user first and then check both properties.