validates user and not user_id