Check for user first before checking signature