login/edit: remaining access from user object