correctly use user.uid to identify the client