fix access level check on user for context.user