move user.strip() pre-sanitize