added self.user to user_policy_callback args