use user instead of auth.user in header