Using User object instead of uri an accesscontrol