force logout if bad user object