Err, make that `user.id` - `userID` is sometimes an email. You should probably rename that accordingly.