a little more debugging...
Pull the user's secret key in a corner case:

  1. The user first runs a command when not logged in, pulling down a user object from the server without his/her private key
  1. The user logs in
  1. So doing doesn't cause the private key to be pulled since the version on the local user object is up-to-date.  That's true, but we didn't get the full story the last time we pull and wrote an incomplete object.  So update it here.