allow user field to be set by authorization