don't try to set @user if not signed in