user - should validate invalid user to falsey