fix self.user -> self.req.user