we extended User to user...

So we should not be using the built-in User object here but rather the `user` object.  This makes user.js and user.json consistent.