- look up requester user and fail if not found