bugfix; $user is a global (yuck)