--- a/dbapi.py	Thu Apr 15 12:46:08 2010 +0200
+++ b/dbapi.py	Thu Apr 15 12:46:57 2010 +0200
@@ -199,7 +199,7 @@
             # these args are initialized after a connection is
             # established
             self.session = None
-            self.cnx = self._user = _NeedAuthAccessMock()
+            self.cnx = self.user = _NeedAuthAccessMock()
 
     def base_url(self):
         return self.vreg.config['base-url']
@@ -215,7 +215,11 @@
         if session.cnx:
             self.cnx = session.cnx
             self.execute = session.cnx.cursor(self).execute
-        self.set_user(user)
+            if user is None:
+                user = self.cnx.user(self, {'lang': self.lang})
+        if user is not None:
+            self.user = user
+            self.set_entity_cache(user)
 
     def execute(self, *args, **kwargs):
         """overriden when session is set. By default raise authentication error
@@ -288,17 +292,6 @@
         req.set_session(self.session, user)
         return req
 
-    @property
-    def user(self):
-        if not self._user and self.cnx:
-            self.set_user(self.cnx.user(self, {'lang': self.lang}))
-        return self._user
-
-    def set_user(self, user):
-        self._user = user
-        if user:
-            self.set_entity_cache(user)
-
     @deprecated('[3.8] use direct access to req.session.data dictionary')
     def session_data(self):
         """return a dictionnary containing session data"""