what if request has no attribute user?