doesn't revalidate the user each request.

This can be a potentially expensive operation.