diff --git a/appview/issues/issues.go b/appview/issues/issues.go
index 34bdcb0d..f2cbf8bb 100644
--- a/appview/issues/issues.go
+++ b/appview/issues/issues.go
@@ -106,7 +106,7 @@ func (rp *Issues) RepoSingleIssue(w http.ResponseWriter, r *http.Request) {
 
 	userReactions := map[models.ReactionKind]bool{}
 	if user != nil {
-		userReactions = db.GetReactionStatusMap(rp.db, user.Active.Did, issue.AtUri())
+		userReactions = db.GetReactionStatusMap(rp.db, user.Did, issue.AtUri())
 	}
 
 	backlinks, err := db.GetBacklinks(rp.db, issue.AtUri())
@@ -185,7 +185,7 @@ func (rp *Issues) EditIssue(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 
-		ex, err := comatproto.RepoGetRecord(r.Context(), client, "", tangled.RepoIssueNSID, user.Active.Did, newIssue.Rkey)
+		ex, err := comatproto.RepoGetRecord(r.Context(), client, "", tangled.RepoIssueNSID, user.Did, newIssue.Rkey)
 		if err != nil {
 			l.Error("failed to get record", "err", err)
 			rp.pages.Notice(w, noticeId, "Failed to edit issue, no record found on PDS.")
@@ -194,7 +194,7 @@ func (rp *Issues) EditIssue(w http.ResponseWriter, r *http.Request) {
 
 		_, err = comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{
 			Collection: tangled.RepoIssueNSID,
-			Repo:       user.Active.Did,
+			Repo:       user.Did,
 			Rkey:       newIssue.Rkey,
 			SwapRecord: ex.Cid,
 			Record: &lexutil.LexiconTypeDecoder{
@@ -309,10 +309,10 @@ func (rp *Issues) CloseIssue(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	roles := repoinfo.RolesInRepo{Roles: rp.enforcer.GetPermissionsInRepo(user.Active.Did, f.Knot, f.RepoIdentifier())}
+	roles := repoinfo.RolesInRepo{Roles: rp.enforcer.GetPermissionsInRepo(user.Did, f.Knot, f.RepoIdentifier())}
 	isRepoOwner := roles.IsOwner()
 	isCollaborator := roles.IsCollaborator()
-	isIssueOwner := user.Active.Did == issue.Did
+	isIssueOwner := user.Did == issue.Did
 
 	// TODO: make this more granular
 	if isIssueOwner || isRepoOwner || isCollaborator {
@@ -329,7 +329,7 @@ func (rp *Issues) CloseIssue(w http.ResponseWriter, r *http.Request) {
 		issue.Open = false
 
 		// notify about the issue closure
-		rp.notifier.NewIssueState(r.Context(), syntax.DID(user.Active.Did), issue)
+		rp.notifier.NewIssueState(r.Context(), syntax.DID(user.Did), issue)
 
 		ownerSlashRepo := reporesolver.GetBaseRepoPath(r, f)
 		rp.pages.HxLocation(w, fmt.Sprintf("/%s/issues/%d", ownerSlashRepo, issue.IssueId))
@@ -357,10 +357,10 @@ func (rp *Issues) ReopenIssue(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	roles := repoinfo.RolesInRepo{Roles: rp.enforcer.GetPermissionsInRepo(user.Active.Did, f.Knot, f.RepoIdentifier())}
+	roles := repoinfo.RolesInRepo{Roles: rp.enforcer.GetPermissionsInRepo(user.Did, f.Knot, f.RepoIdentifier())}
 	isRepoOwner := roles.IsOwner()
 	isCollaborator := roles.IsCollaborator()
-	isIssueOwner := user.Active.Did == issue.Did
+	isIssueOwner := user.Did == issue.Did
 
 	if isCollaborator || isRepoOwner || isIssueOwner {
 		err := db.ReopenIssues(
@@ -376,7 +376,7 @@ func (rp *Issues) ReopenIssue(w http.ResponseWriter, r *http.Request) {
 		issue.Open = true
 
 		// notify about the issue reopen
-		rp.notifier.NewIssueState(r.Context(), syntax.DID(user.Active.Did), issue)
+		rp.notifier.NewIssueState(r.Context(), syntax.DID(user.Did), issue)
 
 		ownerSlashRepo := reporesolver.GetBaseRepoPath(r, f)
 		rp.pages.HxLocation(w, fmt.Sprintf("/%s/issues/%d", ownerSlashRepo, issue.IssueId))
@@ -419,7 +419,7 @@ func (rp *Issues) NewIssueComment(w http.ResponseWriter, r *http.Request) {
 	mentions, references := rp.mentionsResolver.Resolve(r.Context(), body)
 
 	comment := models.IssueComment{
-		Did:        user.Active.Did,
+		Did:        user.Did,
 		Rkey:       tid.TID(),
 		IssueAt:    issue.AtUri().String(),
 		ReplyTo:    replyTo,
@@ -560,8 +560,8 @@ func (rp *Issues) EditIssueComment(w http.ResponseWriter, r *http.Request) {
 	}
 	comment := comments[0]
 
-	if comment.Did != user.Active.Did {
-		l.Error("unauthorized comment edit", "expectedDid", comment.Did, "gotDid", user.Active.Did)
+	if comment.Did != user.Did {
+		l.Error("unauthorized comment edit", "expectedDid", comment.Did, "gotDid", user.Did)
 		http.Error(w, "you are not the author of this comment", http.StatusUnauthorized)
 		return
 	}
@@ -611,7 +611,7 @@ func (rp *Issues) EditIssueComment(w http.ResponseWriter, r *http.Request) {
 		// rkey is optional, it was introduced later
 		if newComment.Rkey != "" {
 			// update the record on pds
-			ex, err := comatproto.RepoGetRecord(r.Context(), client, "", tangled.RepoIssueCommentNSID, user.Active.Did, comment.Rkey)
+			ex, err := comatproto.RepoGetRecord(r.Context(), client, "", tangled.RepoIssueCommentNSID, user.Did, comment.Rkey)
 			if err != nil {
 				l.Error("failed to get record", "err", err, "did", newComment.Did, "rkey", newComment.Rkey)
 				rp.pages.Notice(w, fmt.Sprintf("comment-%s-status", commentId), "Failed to update description, no record found on PDS.")
@@ -620,7 +620,7 @@ func (rp *Issues) EditIssueComment(w http.ResponseWriter, r *http.Request) {
 
 			_, err = comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{
 				Collection: tangled.RepoIssueCommentNSID,
-				Repo:       user.Active.Did,
+				Repo:       user.Did,
 				Rkey:       newComment.Rkey,
 				SwapRecord: ex.Cid,
 				Record: &lexutil.LexiconTypeDecoder{
@@ -742,8 +742,8 @@ func (rp *Issues) DeleteIssueComment(w http.ResponseWriter, r *http.Request) {
 	}
 	comment := comments[0]
 
-	if comment.Did != user.Active.Did {
-		l.Error("unauthorized action", "expectedDid", comment.Did, "gotDid", user.Active.Did)
+	if comment.Did != user.Did {
+		l.Error("unauthorized action", "expectedDid", comment.Did, "gotDid", user.Did)
 		http.Error(w, "you are not the author of this comment", http.StatusUnauthorized)
 		return
 	}
@@ -772,7 +772,7 @@ func (rp *Issues) DeleteIssueComment(w http.ResponseWriter, r *http.Request) {
 		}
 		_, err = comatproto.RepoDeleteRecord(r.Context(), client, &comatproto.RepoDeleteRecord_Input{
 			Collection: tangled.RepoIssueCommentNSID,
-			Repo:       user.Active.Did,
+			Repo:       user.Did,
 			Rkey:       comment.Rkey,
 		})
 		if err != nil {
@@ -1018,7 +1018,7 @@ func (rp *Issues) NewIssue(w http.ResponseWriter, r *http.Request) {
 			Title:      r.FormValue("title"),
 			Body:       body,
 			Open:       true,
-			Did:        user.Active.Did,
+			Did:        user.Did,
 			Created:    time.Now(),
 			Mentions:   mentions,
 			References: references,
@@ -1042,7 +1042,7 @@ func (rp *Issues) NewIssue(w http.ResponseWriter, r *http.Request) {
 		}
 		resp, err := comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{
 			Collection: tangled.RepoIssueNSID,
-			Repo:       user.Active.Did,
+			Repo:       user.Did,
 			Rkey:       issue.Rkey,
 			Record: &lexutil.LexiconTypeDecoder{
 				Val: &record,
diff --git a/appview/knots/knots.go b/appview/knots/knots.go
index 4f266ca2..00505618 100644
--- a/appview/knots/knots.go
+++ b/appview/knots/knots.go
@@ -60,7 +60,7 @@ func (k *Knots) knots(w http.ResponseWriter, r *http.Request) {
 	user := k.OAuth.GetMultiAccountUser(r)
 	registrations, err := db.GetRegistrations(
 		k.Db,
-		orm.FilterEq("did", user.Active.Did),
+		orm.FilterEq("did", user.Did),
 	)
 	if err != nil {
 		k.Logger.Error("failed to fetch knot registrations", "err", err)
@@ -78,7 +78,7 @@ func (k *Knots) dashboard(w http.ResponseWriter, r *http.Request) {
 	l := k.Logger.With("handler", "dashboard")
 
 	user := k.OAuth.GetMultiAccountUser(r)
-	l = l.With("user", user.Active.Did)
+	l = l.With("user", user.Did)
 
 	domain := chi.URLParam(r, "domain")
 	if domain == "" {
@@ -88,7 +88,7 @@ func (k *Knots) dashboard(w http.ResponseWriter, r *http.Request) {
 
 	registrations, err := db.GetRegistrations(
 		k.Db,
-		orm.FilterEq("did", user.Active.Did),
+		orm.FilterEq("did", user.Did),
 		orm.FilterEq("domain", domain),
 	)
 	if err != nil {
@@ -157,7 +157,7 @@ func (k *Knots) register(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	l = l.With("domain", domain)
-	l = l.With("user", user.Active.Did)
+	l = l.With("user", user.Did)
 
 	tx, err := k.Db.Begin()
 	if err != nil {
@@ -170,7 +170,7 @@ func (k *Knots) register(w http.ResponseWriter, r *http.Request) {
 		k.Enforcer.E.LoadPolicy()
 	}()
 
-	err = db.AddKnot(tx, domain, user.Active.Did)
+	err = db.AddKnot(tx, domain, user.Did)
 	if err != nil {
 		l.Error("failed to insert", "err", err)
 		fail()
@@ -192,7 +192,7 @@ func (k *Knots) register(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	ex, _ := comatproto.RepoGetRecord(r.Context(), client, "", tangled.KnotNSID, user.Active.Did, domain)
+	ex, _ := comatproto.RepoGetRecord(r.Context(), client, "", tangled.KnotNSID, user.Did, domain)
 	var exCid *string
 	if ex != nil {
 		exCid = ex.Cid
@@ -201,7 +201,7 @@ func (k *Knots) register(w http.ResponseWriter, r *http.Request) {
 	// re-announce by registering under same rkey
 	_, err = comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{
 		Collection: tangled.KnotNSID,
-		Repo:       user.Active.Did,
+		Repo:       user.Did,
 		Rkey:       domain,
 		Record: &lexutil.LexiconTypeDecoder{
 			Val: &tangled.Knot{
@@ -232,14 +232,14 @@ func (k *Knots) register(w http.ResponseWriter, r *http.Request) {
 	}
 
 	// begin verification
-	err = serververify.RunVerification(r.Context(), domain, user.Active.Did, k.Config.Core.Dev)
+	err = serververify.RunVerification(r.Context(), domain, user.Did, k.Config.Core.Dev)
 	if err != nil {
 		l.Error("verification failed", "err", err)
 		k.Pages.HxRefresh(w)
 		return
 	}
 
-	err = serververify.MarkKnotVerified(k.Db, k.Enforcer, domain, user.Active.Did)
+	err = serververify.MarkKnotVerified(k.Db, k.Enforcer, domain, user.Did)
 	if err != nil {
 		l.Error("failed to mark verified", "err", err)
 		k.Pages.HxRefresh(w)
@@ -276,7 +276,7 @@ func (k *Knots) delete(w http.ResponseWriter, r *http.Request) {
 	// get record from db first
 	registrations, err := db.GetRegistrations(
 		k.Db,
-		orm.FilterEq("did", user.Active.Did),
+		orm.FilterEq("did", user.Did),
 		orm.FilterEq("domain", domain),
 	)
 	if err != nil {
@@ -304,7 +304,7 @@ func (k *Knots) delete(w http.ResponseWriter, r *http.Request) {
 
 	err = db.DeleteKnot(
 		tx,
-		orm.FilterEq("did", user.Active.Did),
+		orm.FilterEq("did", user.Did),
 		orm.FilterEq("domain", domain),
 	)
 	if err != nil {
@@ -332,7 +332,7 @@ func (k *Knots) delete(w http.ResponseWriter, r *http.Request) {
 
 	_, err = comatproto.RepoDeleteRecord(r.Context(), client, &comatproto.RepoDeleteRecord_Input{
 		Collection: tangled.KnotNSID,
-		Repo:       user.Active.Did,
+		Repo:       user.Did,
 		Rkey:       domain,
 	})
 	if err != nil {
@@ -380,12 +380,12 @@ func (k *Knots) retry(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	l = l.With("domain", domain)
-	l = l.With("user", user.Active.Did)
+	l = l.With("user", user.Did)
 
 	// get record from db first
 	registrations, err := db.GetRegistrations(
 		k.Db,
-		orm.FilterEq("did", user.Active.Did),
+		orm.FilterEq("did", user.Did),
 		orm.FilterEq("domain", domain),
 	)
 	if err != nil {
@@ -401,7 +401,7 @@ func (k *Knots) retry(w http.ResponseWriter, r *http.Request) {
 	registration := registrations[0]
 
 	// begin verification
-	err = serververify.RunVerification(r.Context(), domain, user.Active.Did, k.Config.Core.Dev)
+	err = serververify.RunVerification(r.Context(), domain, user.Did, k.Config.Core.Dev)
 	if err != nil {
 		l.Error("verification failed", "err", err)
 
@@ -419,7 +419,7 @@ func (k *Knots) retry(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	err = serververify.MarkKnotVerified(k.Db, k.Enforcer, domain, user.Active.Did)
+	err = serververify.MarkKnotVerified(k.Db, k.Enforcer, domain, user.Did)
 	if err != nil {
 		l.Error("failed to mark verified", "err", err)
 		k.Pages.Notice(w, noticeId, err.Error())
@@ -438,7 +438,7 @@ func (k *Knots) retry(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 
-		ex, _ := comatproto.RepoGetRecord(r.Context(), client, "", tangled.KnotNSID, user.Active.Did, domain)
+		ex, _ := comatproto.RepoGetRecord(r.Context(), client, "", tangled.KnotNSID, user.Did, domain)
 		var exCid *string
 		if ex != nil {
 			exCid = ex.Cid
@@ -447,7 +447,7 @@ func (k *Knots) retry(w http.ResponseWriter, r *http.Request) {
 		// ignore the error here
 		_, err = comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{
 			Collection: tangled.KnotNSID,
-			Repo:       user.Active.Did,
+			Repo:       user.Did,
 			Rkey:       domain,
 			Record: &lexutil.LexiconTypeDecoder{
 				Val: &tangled.Knot{
@@ -476,7 +476,7 @@ func (k *Knots) retry(w http.ResponseWriter, r *http.Request) {
 	// Get updated registration to show
 	registrations, err = db.GetRegistrations(
 		k.Db,
-		orm.FilterEq("did", user.Active.Did),
+		orm.FilterEq("did", user.Did),
 		orm.FilterEq("domain", domain),
 	)
 	if err != nil {
@@ -508,11 +508,11 @@ func (k *Knots) addMember(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	l = l.With("domain", domain)
-	l = l.With("user", user.Active.Did)
+	l = l.With("user", user.Did)
 
 	registrations, err := db.GetRegistrations(
 		k.Db,
-		orm.FilterEq("did", user.Active.Did),
+		orm.FilterEq("did", user.Did),
 		orm.FilterEq("domain", domain),
 		orm.FilterIsNot("registered", "null"),
 	)
@@ -565,7 +565,7 @@ func (k *Knots) addMember(w http.ResponseWriter, r *http.Request) {
 
 	_, err = comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{
 		Collection: tangled.KnotMemberNSID,
-		Repo:       user.Active.Did,
+		Repo:       user.Did,
 		Rkey:       rkey,
 		Record: &lexutil.LexiconTypeDecoder{
 			Val: &tangled.KnotMember{
@@ -616,11 +616,11 @@ func (k *Knots) removeMember(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	l = l.With("domain", domain)
-	l = l.With("user", user.Active.Did)
+	l = l.With("user", user.Did)
 
 	registrations, err := db.GetRegistrations(
 		k.Db,
-		orm.FilterEq("did", user.Active.Did),
+		orm.FilterEq("did", user.Did),
 		orm.FilterEq("domain", domain),
 		orm.FilterIsNot("registered", "null"),
 	)
diff --git a/appview/labels/labels.go b/appview/labels/labels.go
index 76c94a5e..216a68ad 100644
--- a/appview/labels/labels.go
+++ b/appview/labels/labels.go
@@ -86,7 +86,7 @@ func (l *Labels) PerformLabelOp(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	did := user.Active.Did
+	did := user.Did
 	rkey := tid.TID()
 	performedAt := time.Now()
 	indexedAt := time.Now()
diff --git a/appview/middleware/middleware.go b/appview/middleware/middleware.go
index f38f8bea..63b6f664 100644
--- a/appview/middleware/middleware.go
+++ b/appview/middleware/middleware.go
@@ -133,9 +133,9 @@ func (mw Middleware) knotRoleMiddleware(group string) middlewareFunc {
 				return
 			}
 
-			ok, err := mw.enforcer.E.HasGroupingPolicy(actor.Active.Did, group, domain)
+			ok, err := mw.enforcer.E.HasGroupingPolicy(actor.Did, group, domain)
 			if err != nil || !ok {
-				l.Warn("permission denied", "did", actor.Active.Did, "group", group, "domain", domain)
+				l.Warn("permission denied", "did", actor.Did, "group", group, "domain", domain)
 				http.Error(w, "Forbidden", http.StatusUnauthorized)
 				return
 			}
@@ -167,9 +167,9 @@ func (mw Middleware) RepoPermissionMiddleware(requiredPerm string) middlewareFun
 				return
 			}
 
-			ok, err := mw.enforcer.E.Enforce(actor.Active.Did, f.Knot, f.RepoIdentifier(), requiredPerm)
+			ok, err := mw.enforcer.E.Enforce(actor.Did, f.Knot, f.RepoIdentifier(), requiredPerm)
 			if err != nil || !ok {
-				l.Warn("permission denied", "did", actor.Active.Did, "perm", requiredPerm, "repo", f.RepoIdentifier())
+				l.Warn("permission denied", "did", actor.Did, "perm", requiredPerm, "repo", f.RepoIdentifier())
 				http.Error(w, "Forbidden", http.StatusUnauthorized)
 				return
 			}
diff --git a/appview/notifications/notifications.go b/appview/notifications/notifications.go
index 2a63c87a..3cda6baa 100644
--- a/appview/notifications/notifications.go
+++ b/appview/notifications/notifications.go
@@ -54,7 +54,7 @@ func (n *Notifications) notificationsPage(w http.ResponseWriter, r *http.Request
 
 	total, err := db.CountNotifications(
 		n.db,
-		orm.FilterEq("recipient_did", user.Active.Did),
+		orm.FilterEq("recipient_did", user.Did),
 	)
 	if err != nil {
 		l.Error("failed to get total notifications", "err", err)
@@ -65,7 +65,7 @@ func (n *Notifications) notificationsPage(w http.ResponseWriter, r *http.Request
 	notifications, err := db.GetNotificationsWithEntities(
 		n.db,
 		page,
-		orm.FilterEq("recipient_did", user.Active.Did),
+		orm.FilterEq("recipient_did", user.Did),
 	)
 	if err != nil {
 		l.Error("failed to get notifications", "err", err)
@@ -73,7 +73,7 @@ func (n *Notifications) notificationsPage(w http.ResponseWriter, r *http.Request
 		return
 	}
 
-	err = db.MarkAllNotificationsRead(n.db, user.Active.Did)
+	err = db.MarkAllNotificationsRead(n.db, user.Did)
 	if err != nil {
 		l.Error("failed to mark notifications as read", "err", err)
 	}
@@ -98,7 +98,7 @@ func (n *Notifications) getUnreadCount(w http.ResponseWriter, r *http.Request) {
 
 	count, err := db.CountNotifications(
 		n.db,
-		orm.FilterEq("recipient_did", user.Active.Did),
+		orm.FilterEq("recipient_did", user.Did),
 		orm.FilterEq("read", 0),
 	)
 	if err != nil {
diff --git a/appview/oauth/accounts.go b/appview/oauth/accounts.go
index de8c90df..64d48e4b 100644
--- a/appview/oauth/accounts.go
+++ b/appview/oauth/accounts.go
@@ -22,14 +22,10 @@ type AccountRegistry struct {
 }
 
 type MultiAccountUser struct {
-	Active   User
+	Did      string
 	Accounts []AccountInfo
 }
 
-func (m *MultiAccountUser) Did() string {
-	return m.Active.Did
-}
-
 func (o *OAuth) GetAccounts(r *http.Request) *AccountRegistry {
 	session, err := o.SessStore.Get(r, AccountsName)
 	if err != nil || session.IsNew {
@@ -116,9 +112,7 @@ func (o *OAuth) GetMultiAccountUser(r *http.Request) *MultiAccountUser {
 
 	registry := o.GetAccounts(r)
 	return &MultiAccountUser{
-		Active: User{
-			Did: sess.Data.AccountDID.String(),
-		},
+		Did:      sess.Data.AccountDID.String(),
 		Accounts: registry.Accounts,
 	}
 }
diff --git a/appview/oauth/oauth.go b/appview/oauth/oauth.go
index a96469bc..430c89a3 100644
--- a/appview/oauth/oauth.go
+++ b/appview/oauth/oauth.go
@@ -237,13 +237,9 @@ func (o *OAuth) RemoveAccount(w http.ResponseWriter, r *http.Request, targetDid
 	return o.saveAccounts(w, r, registry)
 }
 
-type User struct {
-	Did string
-}
-
 func (o *OAuth) GetDid(r *http.Request) string {
 	if u := o.GetMultiAccountUser(r); u != nil {
-		return u.Did()
+		return u.Did
 	}
 
 	return ""
diff --git a/appview/pulls/pulls.go b/appview/pulls/pulls.go
index ccc470ca..4bca2346 100644
--- a/appview/pulls/pulls.go
+++ b/appview/pulls/pulls.go
@@ -106,7 +106,7 @@ func (s *Pulls) PullActions(w http.ResponseWriter, r *http.Request) {
 	case http.MethodGet:
 		user := s.oauth.GetMultiAccountUser(r)
 		if user != nil {
-			l = l.With("user", user.Active.Did)
+			l = l.With("user", user.Did)
 		}
 
 		f, err := s.repoResolver.Resolve(r)
@@ -140,7 +140,7 @@ func (s *Pulls) PullActions(w http.ResponseWriter, r *http.Request) {
 		mergeCheckResponse := s.mergeCheck(r, f, pull, stack)
 		branchDeleteStatus := s.branchDeleteStatus(r, f, pull)
 		resubmitResult := pages.Unknown
-		if user.Active.Did == pull.OwnerDid {
+		if user.Did == pull.OwnerDid {
 			resubmitResult = s.resubmitCheck(r, f, pull, stack)
 		}
 
@@ -163,7 +163,7 @@ func (s *Pulls) repoPullHelper(w http.ResponseWriter, r *http.Request, interdiff
 
 	user := s.oauth.GetMultiAccountUser(r)
 	if user != nil {
-		l = l.With("user", user.Active.Did)
+		l = l.With("user", user.Did)
 	}
 
 	f, err := s.repoResolver.Resolve(r)
@@ -209,7 +209,7 @@ func (s *Pulls) repoPullHelper(w http.ResponseWriter, r *http.Request, interdiff
 	mergeCheckResponse := s.mergeCheck(r, f, pull, stack)
 	branchDeleteStatus := s.branchDeleteStatus(r, f, pull)
 	resubmitResult := pages.Unknown
-	if user != nil && user.Active.Did == pull.OwnerDid {
+	if user != nil && user.Did == pull.OwnerDid {
 		resubmitResult = s.resubmitCheck(r, f, pull, stack)
 	}
 
@@ -247,7 +247,7 @@ func (s *Pulls) repoPullHelper(w http.ResponseWriter, r *http.Request, interdiff
 
 	userReactions := map[models.ReactionKind]bool{}
 	if user != nil {
-		userReactions = db.GetReactionStatusMap(s.db, user.Active.Did, pull.AtUri())
+		userReactions = db.GetReactionStatusMap(s.db, user.Did, pull.AtUri())
 	}
 
 	labelDefs, err := db.GetLabelDefinitions(
@@ -415,7 +415,7 @@ func (s *Pulls) branchDeleteStatus(r *http.Request, repo *models.Repo, pull *mod
 	}
 
 	// user can only delete branch if they are a collaborator in the repo that the branch belongs to
-	perms := s.enforcer.GetPermissionsInRepo(user.Active.Did, repo.Knot, repo.RepoIdentifier())
+	perms := s.enforcer.GetPermissionsInRepo(user.Did, repo.Knot, repo.RepoIdentifier())
 	if !slices.Contains(perms, "repo:push") {
 		return nil
 	}
@@ -504,7 +504,7 @@ func (s *Pulls) RepoPulls(w http.ResponseWriter, r *http.Request) {
 
 	user := s.oauth.GetMultiAccountUser(r)
 	if user != nil {
-		l = l.With("user", user.Active.Did)
+		l = l.With("user", user.Did)
 	}
 
 	params := r.URL.Query()
@@ -801,7 +801,7 @@ func (s *Pulls) PullComment(w http.ResponseWriter, r *http.Request) {
 
 	user := s.oauth.GetMultiAccountUser(r)
 	if user != nil {
-		l = l.With("user", user.Active.Did)
+		l = l.With("user", user.Did)
 	}
 
 	f, err := s.repoResolver.Resolve(r)
@@ -863,7 +863,7 @@ func (s *Pulls) PullComment(w http.ResponseWriter, r *http.Request) {
 		}
 		atResp, err := comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{
 			Collection: tangled.RepoPullCommentNSID,
-			Repo:       user.Active.Did,
+			Repo:       user.Did,
 			Rkey:       tid.TID(),
 			Record: &lexutil.LexiconTypeDecoder{
 				Val: &tangled.RepoPullComment{
@@ -880,7 +880,7 @@ func (s *Pulls) PullComment(w http.ResponseWriter, r *http.Request) {
 		}
 
 		comment := &models.PullComment{
-			OwnerDid:     user.Active.Did,
+			OwnerDid:     user.Did,
 			RepoAt:       f.RepoAt().String(),
 			PullId:       pull.PullId,
 			Body:         body,
@@ -918,7 +918,7 @@ func (s *Pulls) NewPull(w http.ResponseWriter, r *http.Request) {
 
 	user := s.oauth.GetMultiAccountUser(r)
 	if user != nil {
-		l = l.With("user", user.Active.Did)
+		l = l.With("user", user.Did)
 	}
 
 	f, err := s.repoResolver.Resolve(r)
@@ -974,7 +974,7 @@ func (s *Pulls) NewPull(w http.ResponseWriter, r *http.Request) {
 		fromFork := r.FormValue("fork")
 		sourceBranch := r.FormValue("sourceBranch")
 		patch := r.FormValue("patch")
-		userDid := syntax.DID(user.Active.Did)
+		userDid := syntax.DID(user.Did)
 
 		if targetBranch == "" {
 			s.pages.Notice(w, "pull", "Target branch is required.")
@@ -1603,10 +1603,10 @@ func (s *Pulls) CompareForksFragment(w http.ResponseWriter, r *http.Request) {
 
 	user := s.oauth.GetMultiAccountUser(r)
 	if user != nil {
-		l = l.With("user", user.Active.Did)
+		l = l.With("user", user.Did)
 	}
 
-	forks, err := db.GetForksByDid(s.db, user.Active.Did)
+	forks, err := db.GetForksByDid(s.db, user.Did)
 	if err != nil {
 		l.Error("failed to get forks", "err", err)
 		return
@@ -1624,7 +1624,7 @@ func (s *Pulls) CompareForksBranchesFragment(w http.ResponseWriter, r *http.Requ
 
 	user := s.oauth.GetMultiAccountUser(r)
 	if user != nil {
-		l = l.With("user", user.Active.Did)
+		l = l.With("user", user.Did)
 	}
 
 	f, err := s.repoResolver.Resolve(r)
@@ -1704,7 +1704,7 @@ func (s *Pulls) ResubmitPull(w http.ResponseWriter, r *http.Request) {
 
 	user := s.oauth.GetMultiAccountUser(r)
 	if user != nil {
-		l = l.With("user", user.Active.Did)
+		l = l.With("user", user.Did)
 	}
 
 	pull, ok := r.Context().Value("pull").(*models.Pull)
@@ -1741,7 +1741,7 @@ func (s *Pulls) resubmitPatch(w http.ResponseWriter, r *http.Request) {
 
 	user := s.oauth.GetMultiAccountUser(r)
 	if user != nil {
-		l = l.With("user", user.Active.Did)
+		l = l.With("user", user.Did)
 	}
 
 	pull, ok := r.Context().Value("pull").(*models.Pull)
@@ -1752,8 +1752,8 @@ func (s *Pulls) resubmitPatch(w http.ResponseWriter, r *http.Request) {
 	}
 	l = l.With("pull_id", pull.PullId, "pull_owner", pull.OwnerDid)
 
-	if user == nil || user.Active.Did != pull.OwnerDid {
-		l.Warn("unauthorized user", "actual_user", user.Active.Did, "expected_owner", pull.OwnerDid)
+	if user == nil || user.Did != pull.OwnerDid {
+		l.Warn("unauthorized user", "actual_user", user.Did, "expected_owner", pull.OwnerDid)
 		w.WriteHeader(http.StatusUnauthorized)
 		return
 	}
@@ -1766,7 +1766,7 @@ func (s *Pulls) resubmitPatch(w http.ResponseWriter, r *http.Request) {
 
 	patch := r.FormValue("patch")
 
-	s.resubmitPullHelper(w, r, f, syntax.DID(user.Active.Did), pull, patch, "", "")
+	s.resubmitPullHelper(w, r, f, syntax.DID(user.Did), pull, patch, "", "")
 }
 
 func (s *Pulls) resubmitBranch(w http.ResponseWriter, r *http.Request) {
@@ -1774,7 +1774,7 @@ func (s *Pulls) resubmitBranch(w http.ResponseWriter, r *http.Request) {
 
 	user := s.oauth.GetMultiAccountUser(r)
 	if user != nil {
-		l = l.With("user", user.Active.Did)
+		l = l.With("user", user.Did)
 	}
 
 	pull, ok := r.Context().Value("pull").(*models.Pull)
@@ -1785,8 +1785,8 @@ func (s *Pulls) resubmitBranch(w http.ResponseWriter, r *http.Request) {
 	}
 	l = l.With("pull_id", pull.PullId, "pull_owner", pull.OwnerDid, "target_branch", pull.TargetBranch)
 
-	if user == nil || user.Active.Did != pull.OwnerDid {
-		l.Warn("unauthorized user", "actual_user", user.Active.Did, "expected_owner", pull.OwnerDid)
+	if user == nil || user.Did != pull.OwnerDid {
+		l.Warn("unauthorized user", "actual_user", user.Did, "expected_owner", pull.OwnerDid)
 		w.WriteHeader(http.StatusUnauthorized)
 		return
 	}
@@ -1797,7 +1797,7 @@ func (s *Pulls) resubmitBranch(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	roles := repoinfo.RolesInRepo{Roles: s.enforcer.GetPermissionsInRepo(user.Active.Did, f.Knot, f.RepoIdentifier())}
+	roles := repoinfo.RolesInRepo{Roles: s.enforcer.GetPermissionsInRepo(user.Did, f.Knot, f.RepoIdentifier())}
 	if !roles.IsPushAllowed() {
 		l.Warn("unauthorized user - no push permission")
 		w.WriteHeader(http.StatusUnauthorized)
@@ -1836,7 +1836,7 @@ func (s *Pulls) resubmitBranch(w http.ResponseWriter, r *http.Request) {
 	patch := comparison.FormatPatchRaw
 	combined := comparison.CombinedPatchRaw
 
-	s.resubmitPullHelper(w, r, f, syntax.DID(user.Active.Did), pull, patch, combined, sourceRev)
+	s.resubmitPullHelper(w, r, f, syntax.DID(user.Did), pull, patch, combined, sourceRev)
 }
 
 func (s *Pulls) resubmitFork(w http.ResponseWriter, r *http.Request) {
@@ -1844,7 +1844,7 @@ func (s *Pulls) resubmitFork(w http.ResponseWriter, r *http.Request) {
 
 	user := s.oauth.GetMultiAccountUser(r)
 	if user != nil {
-		l = l.With("user", user.Active.Did)
+		l = l.With("user", user.Did)
 	}
 
 	pull, ok := r.Context().Value("pull").(*models.Pull)
@@ -1855,8 +1855,8 @@ func (s *Pulls) resubmitFork(w http.ResponseWriter, r *http.Request) {
 	}
 	l = l.With("pull_id", pull.PullId, "pull_owner", pull.OwnerDid, "target_branch", pull.TargetBranch)
 
-	if user == nil || user.Active.Did != pull.OwnerDid {
-		l.Warn("unauthorized user", "actual_user", user.Active.Did, "expected_owner", pull.OwnerDid)
+	if user == nil || user.Did != pull.OwnerDid {
+		l.Warn("unauthorized user", "actual_user", user.Did, "expected_owner", pull.OwnerDid)
 		w.WriteHeader(http.StatusUnauthorized)
 		return
 	}
@@ -1939,7 +1939,7 @@ func (s *Pulls) resubmitFork(w http.ResponseWriter, r *http.Request) {
 	patch := comparison.FormatPatchRaw
 	combined := comparison.CombinedPatchRaw
 
-	s.resubmitPullHelper(w, r, f, syntax.DID(user.Active.Did), pull, patch, combined, sourceRev)
+	s.resubmitPullHelper(w, r, f, syntax.DID(user.Did), pull, patch, combined, sourceRev)
 }
 
 func (s *Pulls) resubmitPullHelper(
@@ -2301,7 +2301,7 @@ func (s *Pulls) MergePull(w http.ResponseWriter, r *http.Request) {
 
 	user := s.oauth.GetMultiAccountUser(r)
 	if user != nil {
-		l = l.With("user", user.Active.Did)
+		l = l.With("user", user.Did)
 	}
 
 	f, err := s.repoResolver.Resolve(r)
@@ -2414,7 +2414,7 @@ func (s *Pulls) MergePull(w http.ResponseWriter, r *http.Request) {
 
 	// notify about the pull merge
 	for _, p := range pullsToMerge {
-		s.notifier.NewPullState(r.Context(), syntax.DID(user.Active.Did), p)
+		s.notifier.NewPullState(r.Context(), syntax.DID(user.Did), p)
 	}
 
 	ownerSlashRepo := reporesolver.GetBaseRepoPath(r, f)
@@ -2426,7 +2426,7 @@ func (s *Pulls) ClosePull(w http.ResponseWriter, r *http.Request) {
 
 	user := s.oauth.GetMultiAccountUser(r)
 	if user != nil {
-		l = l.With("user", user.Active.Did)
+		l = l.With("user", user.Did)
 	}
 
 	f, err := s.repoResolver.Resolve(r)
@@ -2444,10 +2444,10 @@ func (s *Pulls) ClosePull(w http.ResponseWriter, r *http.Request) {
 	l = l.With("pull_id", pull.PullId, "pull_owner", pull.OwnerDid)
 
 	// auth filter: only owner or collaborators can close
-	roles := repoinfo.RolesInRepo{Roles: s.enforcer.GetPermissionsInRepo(user.Active.Did, f.Knot, f.RepoIdentifier())}
+	roles := repoinfo.RolesInRepo{Roles: s.enforcer.GetPermissionsInRepo(user.Did, f.Knot, f.RepoIdentifier())}
 	isOwner := roles.IsOwner()
 	isCollaborator := roles.IsCollaborator()
-	isPullAuthor := user.Active.Did == pull.OwnerDid
+	isPullAuthor := user.Did == pull.OwnerDid
 	isCloseAllowed := isOwner || isCollaborator || isPullAuthor
 	if !isCloseAllowed {
 		l.Error("unauthorized to close pull", "is_owner", isOwner, "is_collaborator", isCollaborator, "is_pull_author", isPullAuthor)
@@ -2490,7 +2490,7 @@ func (s *Pulls) ClosePull(w http.ResponseWriter, r *http.Request) {
 	}
 
 	for _, p := range pullsToClose {
-		s.notifier.NewPullState(r.Context(), syntax.DID(user.Active.Did), p)
+		s.notifier.NewPullState(r.Context(), syntax.DID(user.Did), p)
 	}
 
 	ownerSlashRepo := reporesolver.GetBaseRepoPath(r, f)
@@ -2502,7 +2502,7 @@ func (s *Pulls) ReopenPull(w http.ResponseWriter, r *http.Request) {
 
 	user := s.oauth.GetMultiAccountUser(r)
 	if user != nil {
-		l = l.With("user", user.Active.Did)
+		l = l.With("user", user.Did)
 	}
 
 	f, err := s.repoResolver.Resolve(r)
@@ -2521,10 +2521,10 @@ func (s *Pulls) ReopenPull(w http.ResponseWriter, r *http.Request) {
 	l = l.With("pull_id", pull.PullId, "pull_owner", pull.OwnerDid, "state", pull.State)
 
 	// auth filter: only owner or collaborators can close
-	roles := repoinfo.RolesInRepo{Roles: s.enforcer.GetPermissionsInRepo(user.Active.Did, f.Knot, f.RepoIdentifier())}
+	roles := repoinfo.RolesInRepo{Roles: s.enforcer.GetPermissionsInRepo(user.Did, f.Knot, f.RepoIdentifier())}
 	isOwner := roles.IsOwner()
 	isCollaborator := roles.IsCollaborator()
-	isPullAuthor := user.Active.Did == pull.OwnerDid
+	isPullAuthor := user.Did == pull.OwnerDid
 	isCloseAllowed := isOwner || isCollaborator || isPullAuthor
 	if !isCloseAllowed {
 		l.Error("unauthorized to reopen pull", "is_owner", isOwner, "is_collaborator", isCollaborator, "is_pull_author", isPullAuthor)
@@ -2567,7 +2567,7 @@ func (s *Pulls) ReopenPull(w http.ResponseWriter, r *http.Request) {
 	}
 
 	for _, p := range pullsToReopen {
-		s.notifier.NewPullState(r.Context(), syntax.DID(user.Active.Did), p)
+		s.notifier.NewPullState(r.Context(), syntax.DID(user.Did), p)
 	}
 
 	ownerSlashRepo := reporesolver.GetBaseRepoPath(r, f)
diff --git a/appview/repo/artifact.go b/appview/repo/artifact.go
index 9ee08a7b..e4b28bee 100644
--- a/appview/repo/artifact.go
+++ b/appview/repo/artifact.go
@@ -77,7 +77,7 @@ func (rp *Repo) AttachArtifact(w http.ResponseWriter, r *http.Request) {
 
 	putRecordResp, err := comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{
 		Collection: tangled.RepoArtifactNSID,
-		Repo:       user.Active.Did,
+		Repo:       user.Did,
 		Rkey:       rkey,
 		Record: &lexutil.LexiconTypeDecoder{
 			Val: repoArtifactRecord(f, uploadBlobResp.Blob, createdAt, header.Filename, tag.Tag.Hash[:]),
@@ -100,7 +100,7 @@ func (rp *Repo) AttachArtifact(w http.ResponseWriter, r *http.Request) {
 	defer tx.Rollback()
 
 	artifact := models.Artifact{
-		Did:       user.Active.Did,
+		Did:       user.Did,
 		Rkey:      rkey,
 		RepoAt:    f.RepoAt(),
 		Tag:       tag.Tag.Hash,
@@ -251,7 +251,7 @@ func (rp *Repo) DeleteArtifact(w http.ResponseWriter, r *http.Request) {
 
 	artifact := artifacts[0]
 
-	if user.Active.Did != artifact.Did {
+	if user.Did != artifact.Did {
 		l.Error("user not authorized to delete artifact", "err", err)
 		rp.pages.Notice(w, "remove", "Unauthorized deletion of artifact.")
 		return
@@ -259,7 +259,7 @@ func (rp *Repo) DeleteArtifact(w http.ResponseWriter, r *http.Request) {
 
 	_, err = comatproto.RepoDeleteRecord(r.Context(), client, &comatproto.RepoDeleteRecord_Input{
 		Collection: tangled.RepoArtifactNSID,
-		Repo:       user.Active.Did,
+		Repo:       user.Did,
 		Rkey:       artifact.Rkey,
 	})
 	if err != nil {
diff --git a/appview/repo/repo.go b/appview/repo/repo.go
index f10900be..65a574fe 100644
--- a/appview/repo/repo.go
+++ b/appview/repo/repo.go
@@ -92,7 +92,7 @@ func New(
 func (rp *Repo) EditSpindle(w http.ResponseWriter, r *http.Request) {
 	user := rp.oauth.GetMultiAccountUser(r)
 	l := rp.logger.With("handler", "EditSpindle")
-	l = l.With("did", user.Active.Did)
+	l = l.With("did", user.Did)
 
 	errorId := "operation-error"
 	fail := func(msg string, err error) {
@@ -116,7 +116,7 @@ func (rp *Repo) EditSpindle(w http.ResponseWriter, r *http.Request) {
 
 	if !removingSpindle {
 		// ensure that this is a valid spindle for this user
-		validSpindles, err := rp.enforcer.GetSpindlesForUser(user.Active.Did)
+		validSpindles, err := rp.enforcer.GetSpindlesForUser(user.Did)
 		if err != nil {
 			fail("Failed to find spindles. Try again later.", err)
 			return
@@ -179,7 +179,7 @@ func (rp *Repo) EditSpindle(w http.ResponseWriter, r *http.Request) {
 func (rp *Repo) AddLabelDef(w http.ResponseWriter, r *http.Request) {
 	user := rp.oauth.GetMultiAccountUser(r)
 	l := rp.logger.With("handler", "AddLabel")
-	l = l.With("did", user.Active.Did)
+	l = l.With("did", user.Did)
 
 	f, err := rp.repoResolver.Resolve(r)
 	if err != nil {
@@ -225,7 +225,7 @@ func (rp *Repo) AddLabelDef(w http.ResponseWriter, r *http.Request) {
 	}
 
 	label := models.LabelDefinition{
-		Did:       user.Active.Did,
+		Did:       user.Did,
 		Rkey:      tid.TID(),
 		Name:      name,
 		ValueType: valueType,
@@ -341,7 +341,7 @@ func (rp *Repo) AddLabelDef(w http.ResponseWriter, r *http.Request) {
 func (rp *Repo) DeleteLabelDef(w http.ResponseWriter, r *http.Request) {
 	user := rp.oauth.GetMultiAccountUser(r)
 	l := rp.logger.With("handler", "DeleteLabel")
-	l = l.With("did", user.Active.Did)
+	l = l.With("did", user.Did)
 
 	f, err := rp.repoResolver.Resolve(r)
 	if err != nil {
@@ -449,7 +449,7 @@ func (rp *Repo) DeleteLabelDef(w http.ResponseWriter, r *http.Request) {
 func (rp *Repo) SubscribeLabel(w http.ResponseWriter, r *http.Request) {
 	user := rp.oauth.GetMultiAccountUser(r)
 	l := rp.logger.With("handler", "SubscribeLabel")
-	l = l.With("did", user.Active.Did)
+	l = l.With("did", user.Did)
 
 	f, err := rp.repoResolver.Resolve(r)
 	if err != nil {
@@ -535,7 +535,7 @@ func (rp *Repo) SubscribeLabel(w http.ResponseWriter, r *http.Request) {
 func (rp *Repo) UnsubscribeLabel(w http.ResponseWriter, r *http.Request) {
 	user := rp.oauth.GetMultiAccountUser(r)
 	l := rp.logger.With("handler", "UnsubscribeLabel")
-	l = l.With("did", user.Active.Did)
+	l = l.With("did", user.Did)
 
 	f, err := rp.repoResolver.Resolve(r)
 	if err != nil {
@@ -706,7 +706,7 @@ func (rp *Repo) EditLabelPanel(w http.ResponseWriter, r *http.Request) {
 func (rp *Repo) AddCollaborator(w http.ResponseWriter, r *http.Request) {
 	user := rp.oauth.GetMultiAccountUser(r)
 	l := rp.logger.With("handler", "AddCollaborator")
-	l = l.With("did", user.Active.Did)
+	l = l.With("did", user.Did)
 
 	f, err := rp.repoResolver.Resolve(r)
 	if err != nil {
@@ -735,7 +735,7 @@ func (rp *Repo) AddCollaborator(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if collaboratorIdent.DID.String() == user.Active.Did {
+	if collaboratorIdent.DID.String() == user.Did {
 		fail("You seem to be adding yourself as a collaborator.", nil)
 		return
 	}
@@ -755,7 +755,7 @@ func (rp *Repo) AddCollaborator(w http.ResponseWriter, r *http.Request) {
 	createdAt := time.Now()
 	resp, err := comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{
 		Collection: tangled.RepoCollaboratorNSID,
-		Repo:       currentUser.Active.Did,
+		Repo:       currentUser.Did,
 		Rkey:       rkey,
 		Record: &lexutil.LexiconTypeDecoder{
 			Val: repoCollaboratorRecord(f, collaboratorIdent.DID.String(), createdAt),
@@ -801,7 +801,7 @@ func (rp *Repo) AddCollaborator(w http.ResponseWriter, r *http.Request) {
 	}
 
 	err = db.AddCollaborator(tx, models.Collaborator{
-		Did:        syntax.DID(currentUser.Active.Did),
+		Did:        syntax.DID(currentUser.Did),
 		Rkey:       rkey,
 		SubjectDid: collaboratorIdent.DID,
 		RepoAt:     f.RepoAt(),
@@ -849,7 +849,7 @@ func (rp *Repo) DeleteRepo(w http.ResponseWriter, r *http.Request) {
 	}
 	_, err = comatproto.RepoDeleteRecord(r.Context(), atpClient, &comatproto.RepoDeleteRecord_Input{
 		Collection: tangled.RepoNSID,
-		Repo:       user.Active.Did,
+		Repo:       user.Did,
 		Rkey:       f.Rkey,
 	})
 	if err != nil {
@@ -980,7 +980,7 @@ func (rp *Repo) SyncRepoFork(w http.ResponseWriter, r *http.Request) {
 			r.Context(),
 			client,
 			&tangled.RepoForkSync_Input{
-				Did:    user.Active.Did,
+				Did:    user.Did,
 				Name:   f.Name,
 				Source: f.Source,
 				Branch: ref,
@@ -1010,7 +1010,7 @@ func (rp *Repo) ForkRepo(w http.ResponseWriter, r *http.Request) {
 	switch r.Method {
 	case http.MethodGet:
 		user := rp.oauth.GetMultiAccountUser(r)
-		knots, err := rp.enforcer.GetKnotsForUser(user.Active.Did)
+		knots, err := rp.enforcer.GetKnotsForUser(user.Did)
 		if err != nil {
 			rp.pages.Notice(w, "repo", "Invalid user account.")
 			return
@@ -1032,7 +1032,7 @@ func (rp *Repo) ForkRepo(w http.ResponseWriter, r *http.Request) {
 		}
 		l = l.With("targetKnot", targetKnot)
 
-		ok, err := rp.enforcer.E.Enforce(user.Active.Did, targetKnot, targetKnot, "repo:create")
+		ok, err := rp.enforcer.E.Enforce(user.Did, targetKnot, targetKnot, "repo:create")
 		if err != nil || !ok {
 			rp.pages.Notice(w, "repo", "You do not have permission to create a repo in this knot.")
 			return
@@ -1049,7 +1049,7 @@ func (rp *Repo) ForkRepo(w http.ResponseWriter, r *http.Request) {
 		// in the user's account.
 		existingRepo, err := db.GetRepo(
 			rp.db,
-			orm.FilterEq("did", user.Active.Did),
+			orm.FilterEq("did", user.Did),
 			orm.FilterEq("name", forkName),
 		)
 		if err != nil {
@@ -1121,7 +1121,7 @@ func (rp *Repo) ForkRepo(w http.ResponseWriter, r *http.Request) {
 		}
 
 		repo := &models.Repo{
-			Did:         user.Active.Did,
+			Did:         user.Did,
 			Name:        forkName,
 			Knot:        targetKnot,
 			Rkey:        rkey,
@@ -1150,7 +1150,7 @@ func (rp *Repo) ForkRepo(w http.ResponseWriter, r *http.Request) {
 					}
 					ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 					if dErr := tangled.RepoDelete(ctx, deleteClient, &tangled.RepoDelete_Input{
-						Did:  user.Active.Did,
+						Did:  user.Did,
 						Name: forkName,
 						Rkey: rkey,
 					}); dErr != nil {
@@ -1163,7 +1163,7 @@ func (rp *Repo) ForkRepo(w http.ResponseWriter, r *http.Request) {
 					return
 				}
 				l.Error("exhausted retries for knot cleanup, fork may be orphaned",
-					"did", user.Active.Did, "fork", forkName, "knot", targetKnot)
+					"did", user.Did, "fork", forkName, "knot", targetKnot)
 			}()
 		}
 
@@ -1177,7 +1177,7 @@ func (rp *Repo) ForkRepo(w http.ResponseWriter, r *http.Request) {
 
 		atresp, err := comatproto.RepoPutRecord(r.Context(), atpClient, &comatproto.RepoPutRecord_Input{
 			Collection: tangled.RepoNSID,
-			Repo:       user.Active.Did,
+			Repo:       user.Did,
 			Rkey:       rkey,
 			Record: &lexutil.LexiconTypeDecoder{
 				Val: &record,
@@ -1228,7 +1228,7 @@ func (rp *Repo) ForkRepo(w http.ResponseWriter, r *http.Request) {
 		}
 
 		rbacPath := repo.RepoIdentifier()
-		err = rp.enforcer.AddRepo(user.Active.Did, targetKnot, rbacPath)
+		err = rp.enforcer.AddRepo(user.Did, targetKnot, rbacPath)
 		if err != nil {
 			l.Error("failed to add ACLs", "err", err)
 			rp.pages.Notice(w, "repo", "Failed to set up repository permissions.")
@@ -1255,7 +1255,7 @@ func (rp *Repo) ForkRepo(w http.ResponseWriter, r *http.Request) {
 		if repoDid != "" {
 			rp.pages.HxLocation(w, fmt.Sprintf("/%s", repoDid))
 		} else {
-			rp.pages.HxLocation(w, fmt.Sprintf("/%s/%s", user.Active.Did, forkName))
+			rp.pages.HxLocation(w, fmt.Sprintf("/%s/%s", user.Did, forkName))
 		}
 	}
 }
diff --git a/appview/repo/settings.go b/appview/repo/settings.go
index 5379ebe9..8157ab2d 100644
--- a/appview/repo/settings.go
+++ b/appview/repo/settings.go
@@ -72,7 +72,7 @@ func (rp *Repo) SetDefaultBranch(w http.ResponseWriter, r *http.Request) {
 func (rp *Repo) Secrets(w http.ResponseWriter, r *http.Request) {
 	user := rp.oauth.GetMultiAccountUser(r)
 	l := rp.logger.With("handler", "Secrets")
-	l = l.With("did", user.Active.Did)
+	l = l.With("did", user.Did)
 
 	f, err := rp.repoResolver.Resolve(r)
 	if err != nil {
diff --git a/appview/reporesolver/resolver.go b/appview/reporesolver/resolver.go
index cc74b918..cb09bb61 100644
--- a/appview/reporesolver/resolver.go
+++ b/appview/reporesolver/resolver.go
@@ -78,8 +78,8 @@ func (rr *RepoResolver) GetRepoInfo(r *http.Request, user *oauth.MultiAccountUse
 	isStarred := false
 	roles := repoinfo.RolesInRepo{}
 	if user != nil {
-		isStarred = db.GetStarStatus(rr.execer, user.Active.Did, repoAt)
-		roles.Roles = rr.enforcer.GetPermissionsInRepo(user.Active.Did, repo.Knot, repo.RepoIdentifier())
+		isStarred = db.GetStarStatus(rr.execer, user.Did, repoAt)
+		roles.Roles = rr.enforcer.GetPermissionsInRepo(user.Did, repo.Knot, repo.RepoIdentifier())
 	}
 
 	stats := repo.RepoStats
diff --git a/appview/settings/danger.go b/appview/settings/danger.go
index 24b2374c..e77e2702 100644
--- a/appview/settings/danger.go
+++ b/appview/settings/danger.go
@@ -59,7 +59,7 @@ func (s *Settings) revokePdsSession(session *pdsSession) {
 
 func (s *Settings) requestPasswordReset(w http.ResponseWriter, r *http.Request) {
 	user := s.OAuth.GetMultiAccountUser(r)
-	if isTngl, _ := s.isTnglShUser(r.Context(), syntax.DID(user.Active.Did)); !isTngl {
+	if isTngl, _ := s.isTnglShUser(r.Context(), syntax.DID(user.Did)); !isTngl {
 		s.Pages.Notice(w, "password-error", "Only available for tngl.sh accounts.")
 		return
 	}
@@ -100,7 +100,7 @@ func (s *Settings) requestPasswordReset(w http.ResponseWriter, r *http.Request)
 
 func (s *Settings) resetPassword(w http.ResponseWriter, r *http.Request) {
 	user := s.OAuth.GetMultiAccountUser(r)
-	if isTngl, _ := s.isTnglShUser(r.Context(), syntax.DID(user.Active.Did)); !isTngl {
+	if isTngl, _ := s.isTnglShUser(r.Context(), syntax.DID(user.Did)); !isTngl {
 		s.Pages.Notice(w, "password-error", "Only available for tngl.sh accounts.")
 		return
 	}
@@ -134,7 +134,7 @@ func (s *Settings) resetPassword(w http.ResponseWriter, r *http.Request) {
 
 func (s *Settings) deactivateAccount(w http.ResponseWriter, r *http.Request) {
 	user := s.OAuth.GetMultiAccountUser(r)
-	if isTngl, _ := s.isTnglShUser(r.Context(), syntax.DID(user.Active.Did)); !isTngl {
+	if isTngl, _ := s.isTnglShUser(r.Context(), syntax.DID(user.Did)); !isTngl {
 		s.Pages.Notice(w, "deactivate-error", "Only available for tngl.sh accounts.")
 		return
 	}
@@ -172,7 +172,7 @@ func (s *Settings) deactivateAccount(w http.ResponseWriter, r *http.Request) {
 
 func (s *Settings) requestAccountDelete(w http.ResponseWriter, r *http.Request) {
 	user := s.OAuth.GetMultiAccountUser(r)
-	if isTngl, _ := s.isTnglShUser(r.Context(), syntax.DID(user.Active.Did)); !isTngl {
+	if isTngl, _ := s.isTnglShUser(r.Context(), syntax.DID(user.Did)); !isTngl {
 		s.Pages.Notice(w, "delete-error", "Only available for tngl.sh accounts.")
 		return
 	}
@@ -204,7 +204,7 @@ func (s *Settings) requestAccountDelete(w http.ResponseWriter, r *http.Request)
 
 func (s *Settings) deleteAccount(w http.ResponseWriter, r *http.Request) {
 	user := s.OAuth.GetMultiAccountUser(r)
-	if isTngl, _ := s.isTnglShUser(r.Context(), syntax.DID(user.Active.Did)); !isTngl {
+	if isTngl, _ := s.isTnglShUser(r.Context(), syntax.DID(user.Did)); !isTngl {
 		s.Pages.Notice(w, "delete-error", "Only available for tngl.sh accounts.")
 		return
 	}
@@ -269,7 +269,7 @@ func (s *Settings) isAccountDeactivated(ctx context.Context, did syntax.DID) boo
 
 func (s *Settings) reactivateAccount(w http.ResponseWriter, r *http.Request) {
 	user := s.OAuth.GetMultiAccountUser(r)
-	if isTngl, _ := s.isTnglShUser(r.Context(), syntax.DID(user.Active.Did)); !isTngl {
+	if isTngl, _ := s.isTnglShUser(r.Context(), syntax.DID(user.Did)); !isTngl {
 		s.Pages.Notice(w, "reactivate-error", "Only available for tngl.sh accounts.")
 		return
 	}
diff --git a/appview/settings/settings.go b/appview/settings/settings.go
index 4b85bd3d..ea4ca427 100644
--- a/appview/settings/settings.go
+++ b/appview/settings/settings.go
@@ -115,7 +115,7 @@ func (s *Settings) isTnglShUser(ctx context.Context, did syntax.DID) (bool, erro
 func (s *Settings) sitesSettings(w http.ResponseWriter, r *http.Request) {
 	user := s.OAuth.GetMultiAccountUser(r)
 
-	claim, err := db.GetActiveDomainClaimForDid(s.Db, user.Active.Did)
+	claim, err := db.GetActiveDomainClaimForDid(s.Db, user.Did)
 	if err != nil {
 		s.Logger.Error("failed to get domain claim", "err", err)
 		claim = nil
@@ -123,7 +123,7 @@ func (s *Settings) sitesSettings(w http.ResponseWriter, r *http.Request) {
 
 	// determine whether the active account has a tngl.sh handle, in which
 	// case their sites domain is automatically their handle domain.
-	isTnglHandle, _ := s.isTnglHandle(r.Context(), syntax.DID(user.Active.Did))
+	isTnglHandle, _ := s.isTnglHandle(r.Context(), syntax.DID(user.Did))
 
 	s.Pages.UserSiteSettings(w, pages.UserSiteSettingsParams{
 		LoggedInUser: user,
@@ -193,7 +193,7 @@ func (s *Settings) releaseSitesDomain(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	isTnglHandle, err := s.isTnglHandle(r.Context(), syntax.DID(user.Active.Did))
+	isTnglHandle, err := s.isTnglHandle(r.Context(), syntax.DID(user.Did))
 	if err != nil {
 		s.Pages.Notice(w, "settings-sites-error", "Unable to resolve user identity")
 		return
@@ -203,7 +203,7 @@ func (s *Settings) releaseSitesDomain(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if err := db.ReleaseDomain(s.Db, user.Active.Did, domain); err != nil {
+	if err := db.ReleaseDomain(s.Db, user.Did, domain); err != nil {
 		s.Logger.Error("releasing domain", "err", err)
 		s.Pages.Notice(w, "settings-sites-error", "Unable to release domain. Make sure it belongs to your account.")
 		return
@@ -211,12 +211,12 @@ func (s *Settings) releaseSitesDomain(w http.ResponseWriter, r *http.Request) {
 
 	// Clean up all site data for this DID asynchronously.
 	if s.CfClient.Enabled() {
-		siteConfigs, err := db.GetRepoSiteConfigsForDid(s.Db, user.Active.Did)
+		siteConfigs, err := db.GetRepoSiteConfigsForDid(s.Db, user.Did)
 		if err != nil {
 			s.Logger.Error("releaseSitesDomain: fetching site configs for cleanup", "err", err)
 		}
 
-		if err := db.DeleteRepoSiteConfigsForDid(s.Db, user.Active.Did); err != nil {
+		if err := db.DeleteRepoSiteConfigsForDid(s.Db, user.Did); err != nil {
 			s.Logger.Error("releaseSitesDomain: deleting site configs from db", "err", err)
 		}
 
@@ -225,8 +225,8 @@ func (s *Settings) releaseSitesDomain(w http.ResponseWriter, r *http.Request) {
 
 			// Delete each repo's R2 objects.
 			for _, sc := range siteConfigs {
-				if err := sites.Delete(ctx, s.CfClient, user.Active.Did, sc.RepoName); err != nil {
-					s.Logger.Error("releaseSitesDomain: R2 delete failed", "did", user.Active.Did, "repo", sc.RepoName, "err", err)
+				if err := sites.Delete(ctx, s.CfClient, user.Did, sc.RepoName); err != nil {
+					s.Logger.Error("releaseSitesDomain: R2 delete failed", "did", user.Did, "repo", sc.RepoName, "err", err)
 				}
 			}
 
@@ -260,15 +260,15 @@ func isValidSubdomain(s string) bool {
 func (s *Settings) profileSettings(w http.ResponseWriter, r *http.Request) {
 	user := s.OAuth.GetMultiAccountUser(r)
 
-	punchcardPreferences, err := db.GetPunchcardPreference(s.Db, user.Did())
+	punchcardPreferences, err := db.GetPunchcardPreference(s.Db, user.Did)
 	if err != nil {
 		log.Printf("failed to get users punchcard preferences: %s", err)
 	}
 
-	isTnglSh, err := s.isTnglShUser(r.Context(), syntax.DID(user.Active.Did))
+	isTnglSh, err := s.isTnglShUser(r.Context(), syntax.DID(user.Did))
 
 	// TODO: bring the user state from DB instead of PDS request
-	isDeactivated := s.isAccountDeactivated(r.Context(), syntax.DID(user.Active.Did))
+	isDeactivated := s.isAccountDeactivated(r.Context(), syntax.DID(user.Did))
 
 	s.Pages.UserProfileSettings(w, pages.UserProfileSettingsParams{
 		LoggedInUser:        user,
@@ -325,7 +325,7 @@ func (s *Settings) updateNotificationPreferences(w http.ResponseWriter, r *http.
 
 func (s *Settings) keysSettings(w http.ResponseWriter, r *http.Request) {
 	user := s.OAuth.GetMultiAccountUser(r)
-	pubKeys, err := db.GetPublicKeysForDid(s.Db, user.Active.Did)
+	pubKeys, err := db.GetPublicKeysForDid(s.Db, user.Did)
 	if err != nil {
 		s.Logger.Error("keys settings", "err", err)
 	}
@@ -338,7 +338,7 @@ func (s *Settings) keysSettings(w http.ResponseWriter, r *http.Request) {
 
 func (s *Settings) emailsSettings(w http.ResponseWriter, r *http.Request) {
 	user := s.OAuth.GetMultiAccountUser(r)
-	emails, err := db.GetAllEmails(s.Db, user.Active.Did)
+	emails, err := db.GetAllEmails(s.Db, user.Did)
 	if err != nil {
 		s.Logger.Error("emails settings", "err", err)
 	}
@@ -733,7 +733,7 @@ func (s *Settings) keys(w http.ResponseWriter, r *http.Request) {
 
 func (s *Settings) elevateForHandle(w http.ResponseWriter, r *http.Request) {
 	user := s.OAuth.GetMultiAccountUser(r)
-	if isTngl, _ := s.isTnglShUser(r.Context(), syntax.DID(user.Active.Did)); !isTngl {
+	if isTngl, _ := s.isTnglShUser(r.Context(), syntax.DID(user.Did)); !isTngl {
 		http.Redirect(w, r, "/settings/profile", http.StatusSeeOther)
 		return
 	}
@@ -746,7 +746,7 @@ func (s *Settings) elevateForHandle(w http.ResponseWriter, r *http.Request) {
 
 	redirectURL, err := s.OAuth.StartElevatedAuthFlow(
 		r.Context(), w, r,
-		user.Did(),
+		user.Did,
 		[]string{"identity:handle"},
 		"/settings/profile?handle=1",
 	)
@@ -761,7 +761,7 @@ func (s *Settings) elevateForHandle(w http.ResponseWriter, r *http.Request) {
 
 func (s *Settings) updateHandle(w http.ResponseWriter, r *http.Request) {
 	user := s.OAuth.GetMultiAccountUser(r)
-	if isTngl, _ := s.isTnglShUser(r.Context(), syntax.DID(user.Active.Did)); !isTngl {
+	if isTngl, _ := s.isTnglShUser(r.Context(), syntax.DID(user.Did)); !isTngl {
 		s.Pages.Notice(w, "handle-error", "Handle changes are only available for tngl.sh accounts.")
 		return
 	}
@@ -803,7 +803,7 @@ func (s *Settings) updateHandle(w http.ResponseWriter, r *http.Request) {
 		if strings.Contains(err.Error(), "ScopeMissing") || strings.Contains(err.Error(), "insufficient_scope") {
 			redirectURL, elevErr := s.OAuth.StartElevatedAuthFlow(
 				r.Context(), w, r,
-				user.Did(),
+				user.Did,
 				[]string{"identity:handle"},
 				"/settings/profile?handle=1",
 			)
diff --git a/appview/spindles/spindles.go b/appview/spindles/spindles.go
index 7ca4a6d9..26d400a9 100644
--- a/appview/spindles/spindles.go
+++ b/appview/spindles/spindles.go
@@ -60,7 +60,7 @@ func (s *Spindles) spindles(w http.ResponseWriter, r *http.Request) {
 	all, err := db.GetSpindles(
 		r.Context(),
 		s.Db,
-		orm.FilterEq("owner", user.Active.Did),
+		orm.FilterEq("owner", user.Did),
 	)
 	if err != nil {
 		s.Logger.Error("failed to fetch spindles", "err", err)
@@ -79,7 +79,7 @@ func (s *Spindles) dashboard(w http.ResponseWriter, r *http.Request) {
 	l := s.Logger.With("handler", "dashboard")
 
 	user := s.OAuth.GetMultiAccountUser(r)
-	l = l.With("user", user.Active.Did)
+	l = l.With("user", user.Did)
 
 	instance := chi.URLParam(r, "instance")
 	if instance == "" {
@@ -91,7 +91,7 @@ func (s *Spindles) dashboard(w http.ResponseWriter, r *http.Request) {
 		r.Context(),
 		s.Db,
 		orm.FilterEq("instance", instance),
-		orm.FilterEq("owner", user.Active.Did),
+		orm.FilterEq("owner", user.Did),
 		orm.FilterIsNot("verified", "null"),
 	)
 	if err != nil || len(spindles) != 1 {
@@ -162,7 +162,7 @@ func (s *Spindles) register(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	l = l.With("instance", instance)
-	l = l.With("user", user.Active.Did)
+	l = l.With("user", user.Did)
 
 	tx, err := s.Db.Begin()
 	if err != nil {
@@ -176,7 +176,7 @@ func (s *Spindles) register(w http.ResponseWriter, r *http.Request) {
 	}()
 
 	err = db.AddSpindle(tx, models.Spindle{
-		Owner:    syntax.DID(user.Active.Did),
+		Owner:    syntax.DID(user.Did),
 		Instance: instance,
 	})
 	if err != nil {
@@ -200,7 +200,7 @@ func (s *Spindles) register(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	ex, _ := comatproto.RepoGetRecord(r.Context(), client, "", tangled.SpindleNSID, user.Active.Did, instance)
+	ex, _ := comatproto.RepoGetRecord(r.Context(), client, "", tangled.SpindleNSID, user.Did, instance)
 	var exCid *string
 	if ex != nil {
 		exCid = ex.Cid
@@ -209,7 +209,7 @@ func (s *Spindles) register(w http.ResponseWriter, r *http.Request) {
 	// re-announce by registering under same rkey
 	_, err = comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{
 		Collection: tangled.SpindleNSID,
-		Repo:       user.Active.Did,
+		Repo:       user.Did,
 		Rkey:       instance,
 		Record: &lexutil.LexiconTypeDecoder{
 			Val: &tangled.Spindle{
@@ -240,14 +240,14 @@ func (s *Spindles) register(w http.ResponseWriter, r *http.Request) {
 	}
 
 	// begin verification
-	err = serververify.RunVerification(r.Context(), instance, user.Active.Did, s.Config.Core.Dev)
+	err = serververify.RunVerification(r.Context(), instance, user.Did, s.Config.Core.Dev)
 	if err != nil {
 		l.Error("verification failed", "err", err)
 		s.Pages.HxRefresh(w)
 		return
 	}
 
-	_, err = serververify.MarkSpindleVerified(s.Db, s.Enforcer, instance, user.Active.Did)
+	_, err = serververify.MarkSpindleVerified(s.Db, s.Enforcer, instance, user.Did)
 	if err != nil {
 		l.Error("failed to mark verified", "err", err)
 		s.Pages.HxRefresh(w)
@@ -278,7 +278,7 @@ func (s *Spindles) delete(w http.ResponseWriter, r *http.Request) {
 	spindles, err := db.GetSpindles(
 		r.Context(),
 		s.Db,
-		orm.FilterEq("owner", user.Active.Did),
+		orm.FilterEq("owner", user.Did),
 		orm.FilterEq("instance", instance),
 	)
 	if err != nil || len(spindles) != 1 {
@@ -287,8 +287,8 @@ func (s *Spindles) delete(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if string(spindles[0].Owner) != user.Active.Did {
-		l.Error("unauthorized", "user", user.Active.Did, "owner", spindles[0].Owner)
+	if string(spindles[0].Owner) != user.Did {
+		l.Error("unauthorized", "user", user.Did, "owner", spindles[0].Owner)
 		s.Pages.Notice(w, noticeId, "Failed to delete spindle, unauthorized deletion attempt.")
 		return
 	}
@@ -307,7 +307,7 @@ func (s *Spindles) delete(w http.ResponseWriter, r *http.Request) {
 	// remove spindle members first
 	err = db.RemoveSpindleMember(
 		tx,
-		orm.FilterEq("did", user.Active.Did),
+		orm.FilterEq("did", user.Did),
 		orm.FilterEq("instance", instance),
 	)
 	if err != nil {
@@ -318,7 +318,7 @@ func (s *Spindles) delete(w http.ResponseWriter, r *http.Request) {
 
 	err = db.DeleteSpindle(
 		tx,
-		orm.FilterEq("owner", user.Active.Did),
+		orm.FilterEq("owner", user.Did),
 		orm.FilterEq("instance", instance),
 	)
 	if err != nil {
@@ -346,7 +346,7 @@ func (s *Spindles) delete(w http.ResponseWriter, r *http.Request) {
 
 	_, err = comatproto.RepoDeleteRecord(r.Context(), client, &comatproto.RepoDeleteRecord_Input{
 		Collection: tangled.SpindleNSID,
-		Repo:       user.Active.Did,
+		Repo:       user.Did,
 		Rkey:       instance,
 	})
 	if err != nil {
@@ -394,12 +394,12 @@ func (s *Spindles) retry(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	l = l.With("instance", instance)
-	l = l.With("user", user.Active.Did)
+	l = l.With("user", user.Did)
 
 	spindles, err := db.GetSpindles(
 		r.Context(),
 		s.Db,
-		orm.FilterEq("owner", user.Active.Did),
+		orm.FilterEq("owner", user.Did),
 		orm.FilterEq("instance", instance),
 	)
 	if err != nil || len(spindles) != 1 {
@@ -408,14 +408,14 @@ func (s *Spindles) retry(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if string(spindles[0].Owner) != user.Active.Did {
-		l.Error("unauthorized", "user", user.Active.Did, "owner", spindles[0].Owner)
+	if string(spindles[0].Owner) != user.Did {
+		l.Error("unauthorized", "user", user.Did, "owner", spindles[0].Owner)
 		s.Pages.Notice(w, noticeId, "Failed to verify spindle, unauthorized verification attempt.")
 		return
 	}
 
 	// begin verification
-	err = serververify.RunVerification(r.Context(), instance, user.Active.Did, s.Config.Core.Dev)
+	err = serververify.RunVerification(r.Context(), instance, user.Did, s.Config.Core.Dev)
 	if err != nil {
 		l.Error("verification failed", "err", err)
 
@@ -433,7 +433,7 @@ func (s *Spindles) retry(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	rowId, err := serververify.MarkSpindleVerified(s.Db, s.Enforcer, instance, user.Active.Did)
+	rowId, err := serververify.MarkSpindleVerified(s.Db, s.Enforcer, instance, user.Did)
 	if err != nil {
 		l.Error("failed to mark verified", "err", err)
 		s.Pages.Notice(w, noticeId, err.Error())
@@ -472,12 +472,12 @@ func (s *Spindles) addMember(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	l = l.With("instance", instance)
-	l = l.With("user", user.Active.Did)
+	l = l.With("user", user.Did)
 
 	spindles, err := db.GetSpindles(
 		r.Context(),
 		s.Db,
-		orm.FilterEq("owner", user.Active.Did),
+		orm.FilterEq("owner", user.Did),
 		orm.FilterEq("instance", instance),
 	)
 	if err != nil || len(spindles) != 1 {
@@ -492,8 +492,8 @@ func (s *Spindles) addMember(w http.ResponseWriter, r *http.Request) {
 		s.Pages.Notice(w, noticeId, defaultErr)
 	}
 
-	if string(spindles[0].Owner) != user.Active.Did {
-		l.Error("unauthorized", "user", user.Active.Did, "owner", spindles[0].Owner)
+	if string(spindles[0].Owner) != user.Did {
+		l.Error("unauthorized", "user", user.Did, "owner", spindles[0].Owner)
 		s.Pages.Notice(w, noticeId, "Failed to add member, unauthorized attempt.")
 		return
 	}
@@ -542,7 +542,7 @@ func (s *Spindles) addMember(w http.ResponseWriter, r *http.Request) {
 
 	// add member to db
 	if err = db.AddSpindleMember(tx, models.SpindleMember{
-		Did:      syntax.DID(user.Active.Did),
+		Did:      syntax.DID(user.Did),
 		Rkey:     rkey,
 		Instance: instance,
 		Subject:  memberId.DID,
@@ -560,7 +560,7 @@ func (s *Spindles) addMember(w http.ResponseWriter, r *http.Request) {
 
 	_, err = comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{
 		Collection: tangled.SpindleMemberNSID,
-		Repo:       user.Active.Did,
+		Repo:       user.Did,
 		Rkey:       rkey,
 		Record: &lexutil.LexiconTypeDecoder{
 			Val: &tangled.SpindleMember{
@@ -609,12 +609,12 @@ func (s *Spindles) removeMember(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	l = l.With("instance", instance)
-	l = l.With("user", user.Active.Did)
+	l = l.With("user", user.Did)
 
 	spindles, err := db.GetSpindles(
 		r.Context(),
 		s.Db,
-		orm.FilterEq("owner", user.Active.Did),
+		orm.FilterEq("owner", user.Did),
 		orm.FilterEq("instance", instance),
 	)
 	if err != nil || len(spindles) != 1 {
@@ -623,8 +623,8 @@ func (s *Spindles) removeMember(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if string(spindles[0].Owner) != user.Active.Did {
-		l.Error("unauthorized", "user", user.Active.Did, "owner", spindles[0].Owner)
+	if string(spindles[0].Owner) != user.Did {
+		l.Error("unauthorized", "user", user.Did, "owner", spindles[0].Owner)
 		s.Pages.Notice(w, noticeId, "Failed to remove member, unauthorized attempt.")
 		return
 	}
@@ -659,7 +659,7 @@ func (s *Spindles) removeMember(w http.ResponseWriter, r *http.Request) {
 	// get the record from the DB first:
 	members, err := db.GetSpindleMembers(
 		s.Db,
-		orm.FilterEq("did", user.Active.Did),
+		orm.FilterEq("did", user.Did),
 		orm.FilterEq("instance", instance),
 		orm.FilterEq("subject", memberId.DID),
 	)
@@ -672,7 +672,7 @@ func (s *Spindles) removeMember(w http.ResponseWriter, r *http.Request) {
 	// remove from db
 	if err = db.RemoveSpindleMember(
 		tx,
-		orm.FilterEq("did", user.Active.Did),
+		orm.FilterEq("did", user.Did),
 		orm.FilterEq("instance", instance),
 		orm.FilterEq("subject", memberId.DID),
 	); err != nil {
@@ -698,7 +698,7 @@ func (s *Spindles) removeMember(w http.ResponseWriter, r *http.Request) {
 	// remove from pds
 	_, err = comatproto.RepoDeleteRecord(r.Context(), client, &comatproto.RepoDeleteRecord_Input{
 		Collection: tangled.SpindleMemberNSID,
-		Repo:       user.Active.Did,
+		Repo:       user.Did,
 		Rkey:       members[0].Rkey,
 	})
 	if err != nil {
diff --git a/appview/state/accounts.go b/appview/state/accounts.go
index b531fb6a..98dafefb 100644
--- a/appview/state/accounts.go
+++ b/appview/state/accounts.go
@@ -41,7 +41,7 @@ func (s *State) RemoveAccount(w http.ResponseWriter, r *http.Request) {
 	}
 
 	currentUser := s.oauth.GetMultiAccountUser(r)
-	isCurrentAccount := currentUser != nil && currentUser.Active.Did == did
+	isCurrentAccount := currentUser != nil && currentUser.Did == did
 
 	var remainingAccounts []string
 	if currentUser != nil {
diff --git a/appview/state/follow.go b/appview/state/follow.go
index 27878b00..a85a5ff5 100644
--- a/appview/state/follow.go
+++ b/appview/state/follow.go
@@ -29,7 +29,7 @@ func (s *State) Follow(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if currentUser.Active.Did == subjectIdent.DID.String() {
+	if currentUser.Did == subjectIdent.DID.String() {
 		l.Warn("cant follow or unfollow yourself")
 		return
 	}
@@ -46,7 +46,7 @@ func (s *State) Follow(w http.ResponseWriter, r *http.Request) {
 		rkey := tid.TID()
 		resp, err := comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{
 			Collection: tangled.GraphFollowNSID,
-			Repo:       currentUser.Active.Did,
+			Repo:       currentUser.Did,
 			Rkey:       rkey,
 			Record: &lexutil.LexiconTypeDecoder{
 				Val: &tangled.GraphFollow{
@@ -62,7 +62,7 @@ func (s *State) Follow(w http.ResponseWriter, r *http.Request) {
 		l.Info("created atproto record", "uri", resp.Uri)
 
 		follow := &models.Follow{
-			UserDid:    currentUser.Active.Did,
+			UserDid:    currentUser.Did,
 			SubjectDid: subjectIdent.DID.String(),
 			Rkey:       rkey,
 		}
@@ -89,7 +89,7 @@ func (s *State) Follow(w http.ResponseWriter, r *http.Request) {
 		return
 	case http.MethodDelete:
 		// find the record in the db
-		follow, err := db.GetFollow(s.db, currentUser.Active.Did, subjectIdent.DID.String())
+		follow, err := db.GetFollow(s.db, currentUser.Did, subjectIdent.DID.String())
 		if err != nil {
 			l.Error("failed to get follow relationship", "err", err)
 			return
@@ -97,7 +97,7 @@ func (s *State) Follow(w http.ResponseWriter, r *http.Request) {
 
 		_, err = comatproto.RepoDeleteRecord(r.Context(), client, &comatproto.RepoDeleteRecord_Input{
 			Collection: tangled.GraphFollowNSID,
-			Repo:       currentUser.Active.Did,
+			Repo:       currentUser.Did,
 			Rkey:       follow.Rkey,
 		})
 
@@ -106,7 +106,7 @@ func (s *State) Follow(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 
-		err = db.DeleteFollowByRkey(s.db, currentUser.Active.Did, follow.Rkey)
+		err = db.DeleteFollowByRkey(s.db, currentUser.Did, follow.Rkey)
 		if err != nil {
 			l.Warn("failed to delete follow from DB", "err", err)
 			// this is not an issue, the firehose event might have already done this
diff --git a/appview/state/login.go b/appview/state/login.go
index eae4c039..d42a5d6c 100644
--- a/appview/state/login.go
+++ b/appview/state/login.go
@@ -133,7 +133,7 @@ func (s *State) Logout(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	currentDid := currentUser.Active.Did
+	currentDid := currentUser.Did
 
 	var remainingAccounts []string
 	for _, acc := range currentUser.Accounts {
diff --git a/appview/state/profile.go b/appview/state/profile.go
index 46b03286..44b15a93 100644
--- a/appview/state/profile.go
+++ b/appview/state/profile.go
@@ -92,14 +92,10 @@ func (s *State) profile(r *http.Request) (*pages.ProfileCard, error) {
 	loggedInUser := s.oauth.GetMultiAccountUser(r)
 	followStatus := models.IsNotFollowing
 	if loggedInUser != nil {
-		followStatus = db.GetFollowStatus(s.db, loggedInUser.Active.Did, did)
+		followStatus = db.GetFollowStatus(s.db, loggedInUser.Did, did)
 	}
 
-	var loggedInDid string
-	if loggedInUser != nil {
-		loggedInDid = loggedInUser.Did()
-	}
-	showPunchcard := s.shouldShowPunchcard(did, loggedInDid)
+	showPunchcard := s.shouldShowPunchcard(did, loggedInUser.Did)
 
 	var punchcard *models.Punchcard
 	if showPunchcard {
@@ -432,9 +428,9 @@ func (s *State) followPage(
 
 	loggedInUserFollowing := make(map[string]struct{})
 	if loggedInUser != nil {
-		following, err := db.GetFollowing(s.db, loggedInUser.Active.Did)
+		following, err := db.GetFollowing(s.db, loggedInUser.Did)
 		if err != nil {
-			l.Error("failed to get follow list", "err", err, "loggedInUser", loggedInUser.Active.Did)
+			l.Error("failed to get follow list", "err", err, "loggedInUser", loggedInUser.Did)
 			return &params, err
 		}
 		loggedInUserFollowing = make(map[string]struct{}, len(following))
@@ -449,7 +445,7 @@ func (s *State) followPage(
 		followStatus := models.IsNotFollowing
 		if _, exists := loggedInUserFollowing[did]; exists {
 			followStatus = models.IsFollowing
-		} else if loggedInUser != nil && loggedInUser.Active.Did == did {
+		} else if loggedInUser != nil && loggedInUser.Did == did {
 			followStatus = models.IsSelf
 		}
 
@@ -656,12 +652,12 @@ func (s *State) UpdateProfileBio(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	profile, err := db.GetProfile(s.db, user.Active.Did)
+	profile, err := db.GetProfile(s.db, user.Did)
 	if err != nil {
-		l.Error("getting profile data", "did", user.Active.Did, "err", err)
+		l.Error("getting profile data", "did", user.Did, "err", err)
 	}
 	if profile == nil {
-		profile = &models.Profile{Did: user.Active.Did}
+		profile = &models.Profile{Did: user.Did}
 	}
 
 	profile.Description = r.FormValue("description")
@@ -676,7 +672,7 @@ func (s *State) UpdateProfileBio(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 
-		ident, err := s.idResolver.ResolveIdent(r.Context(), user.Active.Did)
+		ident, err := s.idResolver.ResolveIdent(r.Context(), user.Did)
 		if err != nil || !slices.Contains(ident.AlsoKnownAs, "at://"+rawPreferredHandle) {
 			s.pages.Notice(w, "update-profile", "Handle not found in your DID document.")
 			return
@@ -720,12 +716,12 @@ func (s *State) UpdateProfilePins(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	profile, err := db.GetProfile(s.db, user.Active.Did)
+	profile, err := db.GetProfile(s.db, user.Did)
 	if err != nil {
-		l.Error("getting profile data", "did", user.Active.Did, "err", err)
+		l.Error("getting profile data", "did", user.Did, "err", err)
 	}
 	if profile == nil {
-		profile = &models.Profile{Did: user.Active.Did}
+		profile = &models.Profile{Did: user.Did}
 	}
 
 	i := 0
@@ -775,7 +771,7 @@ func (s *State) updateProfile(profile *models.Profile, w http.ResponseWriter, r
 		vanityStats = append(vanityStats, string(v.Kind))
 	}
 
-	ex, _ := comatproto.RepoGetRecord(r.Context(), client, "", tangled.ActorProfileNSID, user.Active.Did, "self")
+	ex, _ := comatproto.RepoGetRecord(r.Context(), client, "", tangled.ActorProfileNSID, user.Did, "self")
 	var cid *string
 	var existingAvatar *lexutil.LexBlob
 	if ex != nil {
@@ -787,7 +783,7 @@ func (s *State) updateProfile(profile *models.Profile, w http.ResponseWriter, r
 
 	_, err = comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{
 		Collection: tangled.ActorProfileNSID,
-		Repo:       user.Active.Did,
+		Repo:       user.Did,
 		Rkey:       "self",
 		Record: &lexutil.LexiconTypeDecoder{
 			Val: &tangled.ActorProfile{
@@ -818,23 +814,23 @@ func (s *State) updateProfile(profile *models.Profile, w http.ResponseWriter, r
 
 	s.notifier.UpdateProfile(r.Context(), profile)
 
-	s.pages.HxRedirect(w, "/"+user.Active.Did)
+	s.pages.HxRedirect(w, "/"+user.Did)
 }
 
 func (s *State) EditBioFragment(w http.ResponseWriter, r *http.Request) {
 	l := s.logger.With("handler", "EditBioFragment")
 	user := s.oauth.GetMultiAccountUser(r)
 
-	profile, err := db.GetProfile(s.db, user.Active.Did)
+	profile, err := db.GetProfile(s.db, user.Did)
 	if err != nil {
-		l.Error("getting profile data", "did", user.Active.Did, "err", err)
+		l.Error("getting profile data", "did", user.Did, "err", err)
 	}
 	if profile == nil {
-		profile = &models.Profile{Did: user.Active.Did}
+		profile = &models.Profile{Did: user.Did}
 	}
 
 	var alsoKnownAs []string
-	ident, err := s.idResolver.ResolveIdent(r.Context(), user.Active.Did)
+	ident, err := s.idResolver.ResolveIdent(r.Context(), user.Did)
 	if err == nil {
 		alsoKnownAs = ident.AlsoKnownAs
 	}
@@ -850,22 +846,22 @@ func (s *State) EditPinsFragment(w http.ResponseWriter, r *http.Request) {
 	l := s.logger.With("handler", "EditPinsFragment")
 	user := s.oauth.GetMultiAccountUser(r)
 
-	profile, err := db.GetProfile(s.db, user.Active.Did)
+	profile, err := db.GetProfile(s.db, user.Did)
 	if err != nil {
-		l.Error("getting profile data", "did", user.Active.Did, "err", err)
+		l.Error("getting profile data", "did", user.Did, "err", err)
 	}
 	if profile == nil {
-		profile = &models.Profile{Did: user.Active.Did}
+		profile = &models.Profile{Did: user.Did}
 	}
 
-	repos, err := db.GetRepos(s.db, orm.FilterEq("did", user.Active.Did))
+	repos, err := db.GetRepos(s.db, orm.FilterEq("did", user.Did))
 	if err != nil {
-		l.Error("getting repos", "did", user.Active.Did, "err", err)
+		l.Error("getting repos", "did", user.Did, "err", err)
 	}
 
-	collaboratingRepos, err := db.CollaboratingIn(s.db, user.Active.Did)
+	collaboratingRepos, err := db.CollaboratingIn(s.db, user.Did)
 	if err != nil {
-		l.Error("getting collaborating repos", "did", user.Active.Did, "err", err)
+		l.Error("getting collaborating repos", "did", user.Did, "err", err)
 	}
 
 	allRepos := []pages.PinnedRepo{}
@@ -893,7 +889,7 @@ func (s *State) EditPinsFragment(w http.ResponseWriter, r *http.Request) {
 func (s *State) UploadProfileAvatar(w http.ResponseWriter, r *http.Request) {
 	l := s.logger.With("handler", "UploadProfileAvatar")
 	user := s.oauth.GetMultiAccountUser(r)
-	l = l.With("did", user.Active.Did)
+	l = l.With("did", user.Did)
 
 	// Parse multipart form (10MB max)
 	if err := r.ParseMultipartForm(10 << 20); err != nil {
@@ -940,7 +936,7 @@ func (s *State) UploadProfileAvatar(w http.ResponseWriter, r *http.Request) {
 	l.Info("uploaded avatar blob", "cid", uploadBlobResp.Blob.Ref.String())
 
 	// get current profile record from PDS to get its CID for swap
-	getRecordResp, err := comatproto.RepoGetRecord(r.Context(), client, "", tangled.ActorProfileNSID, user.Active.Did, "self")
+	getRecordResp, err := comatproto.RepoGetRecord(r.Context(), client, "", tangled.ActorProfileNSID, user.Did, "self")
 	if err != nil {
 		l.Error("failed to get current profile record", "err", err)
 		s.pages.Notice(w, "avatar-error", "Failed to get current profile from your PDS")
@@ -964,7 +960,7 @@ func (s *State) UploadProfileAvatar(w http.ResponseWriter, r *http.Request) {
 
 	_, err = comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{
 		Collection: tangled.ActorProfileNSID,
-		Repo:       user.Active.Did,
+		Repo:       user.Did,
 		Rkey:       "self",
 		Record:     &lexutil.LexiconTypeDecoder{Val: profileRecord},
 		SwapRecord: getRecordResp.Cid,
@@ -978,12 +974,12 @@ func (s *State) UploadProfileAvatar(w http.ResponseWriter, r *http.Request) {
 
 	l.Info("successfully updated profile with avatar")
 
-	profile, err := db.GetProfile(s.db, user.Active.Did)
+	profile, err := db.GetProfile(s.db, user.Did)
 	if err != nil {
 		l.Warn("getting profile data from DB", "err", err)
 	}
 	if profile == nil {
-		profile = &models.Profile{Did: user.Active.Did}
+		profile = &models.Profile{Did: user.Did}
 	}
 	profile.Avatar = uploadBlobResp.Blob.Ref.String()
 
@@ -1009,7 +1005,7 @@ func (s *State) UploadProfileAvatar(w http.ResponseWriter, r *http.Request) {
 func (s *State) RemoveProfileAvatar(w http.ResponseWriter, r *http.Request) {
 	l := s.logger.With("handler", "RemoveProfileAvatar")
 	user := s.oauth.GetMultiAccountUser(r)
-	l = l.With("did", user.Active.Did)
+	l = l.With("did", user.Did)
 
 	client, err := s.oauth.AuthorizedClient(r)
 	if err != nil {
@@ -1018,7 +1014,7 @@ func (s *State) RemoveProfileAvatar(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	getRecordResp, err := comatproto.RepoGetRecord(r.Context(), client, "", tangled.ActorProfileNSID, user.Active.Did, "self")
+	getRecordResp, err := comatproto.RepoGetRecord(r.Context(), client, "", tangled.ActorProfileNSID, user.Did, "self")
 	if err != nil {
 		l.Error("failed to get current profile record", "err", err)
 		s.pages.Notice(w, "avatar-error", "Failed to get current profile from your PDS")
@@ -1042,7 +1038,7 @@ func (s *State) RemoveProfileAvatar(w http.ResponseWriter, r *http.Request) {
 
 	_, err = comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{
 		Collection: tangled.ActorProfileNSID,
-		Repo:       user.Active.Did,
+		Repo:       user.Did,
 		Rkey:       "self",
 		Record:     &lexutil.LexiconTypeDecoder{Val: profileRecord},
 		SwapRecord: getRecordResp.Cid,
@@ -1056,12 +1052,12 @@ func (s *State) RemoveProfileAvatar(w http.ResponseWriter, r *http.Request) {
 
 	l.Info("successfully removed avatar from PDS")
 
-	profile, err := db.GetProfile(s.db, user.Active.Did)
+	profile, err := db.GetProfile(s.db, user.Did)
 	if err != nil {
 		l.Warn("getting profile data from DB", "err", err)
 	}
 	if profile == nil {
-		profile = &models.Profile{Did: user.Active.Did}
+		profile = &models.Profile{Did: user.Did}
 	}
 	profile.Avatar = ""
 
@@ -1103,7 +1099,7 @@ func (s *State) UpdateProfilePunchcardSetting(w http.ResponseWriter, r *http.Req
 		hideOthers = true
 	}
 
-	err = db.UpsertPunchcardPreference(s.db, user.Active.Did, hideMine, hideOthers)
+	err = db.UpsertPunchcardPreference(s.db, user.Did, hideMine, hideOthers)
 	if err != nil {
 		l.Error("failed to update punchcard preferences", "err", err)
 		return
diff --git a/appview/state/reaction.go b/appview/state/reaction.go
index 208f0a5c..d887a28c 100644
--- a/appview/state/reaction.go
+++ b/appview/state/reaction.go
@@ -49,7 +49,7 @@ func (s *State) React(w http.ResponseWriter, r *http.Request) {
 		rkey := tid.TID()
 		resp, err := comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{
 			Collection: tangled.FeedReactionNSID,
-			Repo:       currentUser.Active.Did,
+			Repo:       currentUser.Did,
 			Rkey:       rkey,
 			Record: &lexutil.LexiconTypeDecoder{
 				Val: &tangled.FeedReaction{
@@ -64,7 +64,7 @@ func (s *State) React(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 
-		err = db.AddReaction(s.db, currentUser.Active.Did, subjectUri, reactionKind, rkey)
+		err = db.AddReaction(s.db, currentUser.Did, subjectUri, reactionKind, rkey)
 		if err != nil {
 			l.Error("failed to react", "err", err)
 			return
@@ -87,15 +87,15 @@ func (s *State) React(w http.ResponseWriter, r *http.Request) {
 
 		return
 	case http.MethodDelete:
-		reaction, err := db.GetReaction(s.db, currentUser.Active.Did, subjectUri, reactionKind)
+		reaction, err := db.GetReaction(s.db, currentUser.Did, subjectUri, reactionKind)
 		if err != nil {
-			l.Error("failed to get reaction relationship", "did", currentUser.Active.Did, "subjectUri", subjectUri, "err", err)
+			l.Error("failed to get reaction relationship", "did", currentUser.Did, "subjectUri", subjectUri, "err", err)
 			return
 		}
 
 		_, err = comatproto.RepoDeleteRecord(r.Context(), client, &comatproto.RepoDeleteRecord_Input{
 			Collection: tangled.FeedReactionNSID,
-			Repo:       currentUser.Active.Did,
+			Repo:       currentUser.Did,
 			Rkey:       reaction.Rkey,
 		})
 
@@ -104,7 +104,7 @@ func (s *State) React(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 
-		err = db.DeleteReactionByRkey(s.db, currentUser.Active.Did, reaction.Rkey)
+		err = db.DeleteReactionByRkey(s.db, currentUser.Did, reaction.Rkey)
 		if err != nil {
 			l.Warn("failed to delete reaction from DB", "err", err)
 			// this is not an issue, the firehose event might have already done this
diff --git a/appview/state/star.go b/appview/state/star.go
index b5a42948..4a9a460b 100644
--- a/appview/state/star.go
+++ b/appview/state/star.go
@@ -56,7 +56,7 @@ func (s *State) Star(w http.ResponseWriter, r *http.Request) {
 
 		resp, err := comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{
 			Collection: tangled.FeedStarNSID,
-			Repo:       currentUser.Active.Did,
+			Repo:       currentUser.Did,
 			Rkey:       rkey,
 			Record:     &lexutil.LexiconTypeDecoder{Val: starRecord},
 		})
@@ -67,7 +67,7 @@ func (s *State) Star(w http.ResponseWriter, r *http.Request) {
 		l.Info("created atproto record", "uri", resp.Uri)
 
 		star := &models.Star{
-			Did:    currentUser.Active.Did,
+			Did:    currentUser.Did,
 			RepoAt: subjectUri,
 			Rkey:   rkey,
 		}
@@ -95,7 +95,7 @@ func (s *State) Star(w http.ResponseWriter, r *http.Request) {
 		return
 	case http.MethodDelete:
 		// find the record in the db
-		star, err := db.GetStar(s.db, currentUser.Active.Did, subjectUri)
+		star, err := db.GetStar(s.db, currentUser.Did, subjectUri)
 		if err != nil {
 			l.Error("failed to get star relationship", "err", err)
 			return
@@ -103,7 +103,7 @@ func (s *State) Star(w http.ResponseWriter, r *http.Request) {
 
 		_, err = comatproto.RepoDeleteRecord(r.Context(), client, &comatproto.RepoDeleteRecord_Input{
 			Collection: tangled.FeedStarNSID,
-			Repo:       currentUser.Active.Did,
+			Repo:       currentUser.Did,
 			Rkey:       star.Rkey,
 		})
 
@@ -112,7 +112,7 @@ func (s *State) Star(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 
-		err = db.DeleteStarByRkey(s.db, currentUser.Active.Did, star.Rkey)
+		err = db.DeleteStarByRkey(s.db, currentUser.Did, star.Rkey)
 		if err != nil {
 			l.Warn("failed to delete star from DB", "err", err)
 			// this is not an issue, the firehose event might have already done this
diff --git a/appview/state/state.go b/appview/state/state.go
index de95850d..6899e5ae 100644
--- a/appview/state/state.go
+++ b/appview/state/state.go
@@ -286,11 +286,11 @@ func (s *State) UpgradeBanner(w http.ResponseWriter, r *http.Request) {
 	}
 
 	l := s.logger.With("handler", "UpgradeBanner")
-	l = l.With("did", user.Active.Did)
+	l = l.With("did", user.Did)
 
 	regs, err := db.GetRegistrations(
 		s.db,
-		orm.FilterEq("did", user.Active.Did),
+		orm.FilterEq("did", user.Did),
 		orm.FilterEq("needs_upgrade", 1),
 	)
 	if err != nil {
@@ -300,7 +300,7 @@ func (s *State) UpgradeBanner(w http.ResponseWriter, r *http.Request) {
 	spindles, err := db.GetSpindles(
 		r.Context(),
 		s.db,
-		orm.FilterEq("owner", user.Active.Did),
+		orm.FilterEq("owner", user.Did),
 		orm.FilterEq("needs_upgrade", 1),
 	)
 	if err != nil {
@@ -390,7 +390,7 @@ func (s *State) NewRepo(w http.ResponseWriter, r *http.Request) {
 	switch r.Method {
 	case http.MethodGet:
 		user := s.oauth.GetMultiAccountUser(r)
-		knots, err := s.enforcer.GetKnotsForUser(user.Active.Did)
+		knots, err := s.enforcer.GetKnotsForUser(user.Did)
 		if err != nil {
 			s.pages.Notice(w, "repo", "Invalid user account.")
 			return
@@ -405,7 +405,7 @@ func (s *State) NewRepo(w http.ResponseWriter, r *http.Request) {
 		l := s.logger.With("handler", "NewRepo")
 
 		user := s.oauth.GetMultiAccountUser(r)
-		l = l.With("did", user.Active.Did)
+		l = l.With("did", user.Did)
 
 		// form validation
 		domain := r.FormValue("domain")
@@ -441,7 +441,7 @@ func (s *State) NewRepo(w http.ResponseWriter, r *http.Request) {
 		}
 
 		// ACL validation
-		ok, err := s.enforcer.E.Enforce(user.Active.Did, domain, domain, "repo:create")
+		ok, err := s.enforcer.E.Enforce(user.Did, domain, domain, "repo:create")
 		if err != nil || !ok {
 			l.Info("unauthorized")
 			s.pages.Notice(w, "repo", "You do not have permission to create a repo in this knot.")
@@ -451,7 +451,7 @@ func (s *State) NewRepo(w http.ResponseWriter, r *http.Request) {
 		// Check for existing repos
 		existingRepo, err := db.GetRepo(
 			s.db,
-			orm.FilterEq("did", user.Active.Did),
+			orm.FilterEq("did", user.Did),
 			orm.FilterEq("name", repoName),
 		)
 		if err == nil && existingRepo != nil {
@@ -501,7 +501,7 @@ func (s *State) NewRepo(w http.ResponseWriter, r *http.Request) {
 		}
 
 		repo := &models.Repo{
-			Did:         user.Active.Did,
+			Did:         user.Did,
 			Name:        repoName,
 			Knot:        domain,
 			Rkey:        rkey,
@@ -529,7 +529,7 @@ func (s *State) NewRepo(w http.ResponseWriter, r *http.Request) {
 					}
 					ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 					if dErr := tangled.RepoDelete(ctx, deleteClient, &tangled.RepoDelete_Input{
-						Did:  user.Active.Did,
+						Did:  user.Did,
 						Name: repoName,
 						Rkey: rkey,
 					}); dErr != nil {
@@ -542,7 +542,7 @@ func (s *State) NewRepo(w http.ResponseWriter, r *http.Request) {
 					return
 				}
 				l.Error("exhausted retries for knot cleanup, repo may be orphaned",
-					"did", user.Active.Did, "repo", repoName, "knot", domain)
+					"did", user.Did, "repo", repoName, "knot", domain)
 			}()
 		}
 
@@ -556,7 +556,7 @@ func (s *State) NewRepo(w http.ResponseWriter, r *http.Request) {
 
 		atresp, err := comatproto.RepoPutRecord(r.Context(), atpClient, &comatproto.RepoPutRecord_Input{
 			Collection: tangled.RepoNSID,
-			Repo:       user.Active.Did,
+			Repo:       user.Did,
 			Rkey:       rkey,
 			Record: &lexutil.LexiconTypeDecoder{
 				Val: &record,
@@ -607,7 +607,7 @@ func (s *State) NewRepo(w http.ResponseWriter, r *http.Request) {
 		}
 
 		rbacPath := repo.RepoIdentifier()
-		err = s.enforcer.AddRepo(user.Active.Did, domain, rbacPath)
+		err = s.enforcer.AddRepo(user.Did, domain, rbacPath)
 		if err != nil {
 			l.Error("acl setup failed", "err", err)
 			s.pages.Notice(w, "repo", "Failed to set up repository permissions.")
@@ -634,7 +634,7 @@ func (s *State) NewRepo(w http.ResponseWriter, r *http.Request) {
 		if repoDid != "" {
 			s.pages.HxLocation(w, fmt.Sprintf("/%s", repoDid))
 		} else {
-			s.pages.HxLocation(w, fmt.Sprintf("/%s/%s", user.Active.Did, repoName))
+			s.pages.HxLocation(w, fmt.Sprintf("/%s/%s", user.Did, repoName))
 		}
 	}
 }
diff --git a/appview/state/timeline.go b/appview/state/timeline.go
index 1a231766..39754a9c 100644
--- a/appview/state/timeline.go
+++ b/appview/state/timeline.go
@@ -48,7 +48,7 @@ func (s *State) Timeline(w http.ResponseWriter, r *http.Request) {
 
 	var userDid string
 	if user != nil {
-		userDid = user.Active.Did
+		userDid = user.Did
 	}
 	timeline, err := db.MakeTimeline(s.db, 50, userDid, filtered)
 	if err != nil {
diff --git a/appview/strings/strings.go b/appview/strings/strings.go
index cdbb93a8..dff3c64f 100644
--- a/appview/strings/strings.go
+++ b/appview/strings/strings.go
@@ -156,7 +156,7 @@ func (s *Strings) contents(w http.ResponseWriter, r *http.Request) {
 	user := s.OAuth.GetMultiAccountUser(r)
 	isStarred := false
 	if user != nil {
-		isStarred = db.GetStarStatus(s.Db, user.Active.Did, string.AtUri())
+		isStarred = db.GetStarStatus(s.Db, user.Did, string.AtUri())
 	}
 
 	s.Pages.SingleString(w, pages.SingleStringParams{
@@ -216,8 +216,8 @@ func (s *Strings) edit(w http.ResponseWriter, r *http.Request) {
 	first := all[0]
 
 	// verify that the logged in user owns this string
-	if user.Active.Did != id.DID.String() {
-		l.Error("unauthorized request", "expected", id.DID, "got", user.Active.Did)
+	if user.Did != id.DID.String() {
+		l.Error("unauthorized request", "expected", id.DID, "got", user.Did)
 		w.WriteHeader(http.StatusUnauthorized)
 		return
 	}
@@ -299,7 +299,7 @@ func (s *Strings) edit(w http.ResponseWriter, r *http.Request) {
 		s.Notifier.EditString(r.Context(), &entry)
 
 		// if that went okay, redir to the string
-		s.Pages.HxRedirect(w, "/strings/"+user.Active.Did+"/"+entry.Rkey)
+		s.Pages.HxRedirect(w, "/strings/"+user.Did+"/"+entry.Rkey)
 	}
 
 }
@@ -335,7 +335,7 @@ func (s *Strings) create(w http.ResponseWriter, r *http.Request) {
 		description := r.FormValue("description")
 
 		string := models.String{
-			Did:         syntax.DID(user.Active.Did),
+			Did:         syntax.DID(user.Did),
 			Rkey:        tid.TID(),
 			Filename:    filename,
 			Description: description,
@@ -353,7 +353,7 @@ func (s *Strings) create(w http.ResponseWriter, r *http.Request) {
 
 		resp, err := comatproto.RepoPutRecord(r.Context(), client, &atproto.RepoPutRecord_Input{
 			Collection: tangled.StringNSID,
-			Repo:       user.Active.Did,
+			Repo:       user.Did,
 			Rkey:       string.Rkey,
 			Record: &lexutil.LexiconTypeDecoder{
 				Val: &record,
@@ -375,7 +375,7 @@ func (s *Strings) create(w http.ResponseWriter, r *http.Request) {
 		s.Notifier.NewString(r.Context(), &string)
 
 		// successful
-		s.Pages.HxRedirect(w, "/strings/"+user.Active.Did+"/"+string.Rkey)
+		s.Pages.HxRedirect(w, "/strings/"+user.Did+"/"+string.Rkey)
 	}
 }
 
@@ -402,8 +402,8 @@ func (s *Strings) delete(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if user.Active.Did != id.DID.String() {
-		fail("You cannot delete this string", fmt.Errorf("unauthorized deletion, %s != %s", user.Active.Did, id.DID.String()))
+	if user.Did != id.DID.String() {
+		fail("You cannot delete this string", fmt.Errorf("unauthorized deletion, %s != %s", user.Did, id.DID.String()))
 		return
 	}
 
@@ -415,7 +415,7 @@ func (s *Strings) delete(w http.ResponseWriter, r *http.Request) {
 
 	_, err = comatproto.RepoDeleteRecord(r.Context(), client, &comatproto.RepoDeleteRecord_Input{
 		Collection: tangled.StringNSID,
-		Repo:       user.Active.Did,
+		Repo:       user.Did,
 		Rkey:       rkey,
 	})
 	if err != nil {
@@ -425,16 +425,16 @@ func (s *Strings) delete(w http.ResponseWriter, r *http.Request) {
 
 	if err := db.DeleteString(
 		s.Db,
-		orm.FilterEq("did", user.Active.Did),
+		orm.FilterEq("did", user.Did),
 		orm.FilterEq("rkey", rkey),
 	); err != nil {
 		fail("Failed to delete string.", err)
 		return
 	}
 
-	s.Notifier.DeleteString(r.Context(), user.Active.Did, rkey)
+	s.Notifier.DeleteString(r.Context(), user.Did, rkey)
 
-	s.Pages.HxRedirect(w, "/strings/"+user.Active.Did)
+	s.Pages.HxRedirect(w, "/strings/"+user.Did)
 }
 
 func (s *Strings) comment(w http.ResponseWriter, r *http.Request) {