we can no longer access the user from the key object, so just make up a random key...