can we be sure that `user` is always defined?