if user is false, it means the auth failed.  should not continue then