fix(auth): guard against undefined user