FIX: don't crash from observer if user record is bad