if (user != null) {
user = new NodeFactory<Principal>(securityContext).instantiate(user.getNode());
// convert to user
user.unlockReadOnlyPropertiesOnce();
user.setProperty(AbstractNode.type, User.class.getSimpleName());
user.setProperty(User.confirmationKey, confKey);
} else if (autoCreate) {