more docs; require that request->user already be set