Why do we need this here? The user should be assigned after logging in in security step or right away if he is already signed in. I'd be in favor of doing this through events. (IIRC in one of PRs I did that...)