I think you need `@user` in update action as well.