I am so wrong. It *is* getting double-serialized, as @shady pointed out: `s:192:"a:5:{s:10:"user_`. It's a serialized string containing the serialized array.