oh no -- was using the loaded user resource instead of the authenticated user in the header; now fixed