validate: empty user_data is also valid