I would set unexpected_keys[user] here as well.  The keys are unexpected for both cases.