user->access_to is now always available