in login require situation, mutable inject 'user' parameter