Actually, we should get this from the security context or the currently logged in user. Think about administrator adding it from the backend. The promotion has to be applied, but not for the currently loggedin user. It has to be applied for the customer.

This can be greatly simplified by getting the user from the ``Order`` model itself. (the subject here) ``$subject->getUser()``. Also, remember about checking if the user is set.