must set user.email and user.name