use user instead of user_id
fix that annoying bug with no cors on errors
UPDATES
switch to accessible_by