Used only where potentially a user is required. It doesn't make sense to extract a user for request that don't need a user in the context.