haypo, you missed this comment from gps on Rietveld:

> As for the _user = user stuff, the reason that is being done is so
> that the original user and or group value can be included in the
> raised exception error message.  That is actually a nice thing to do.
> 
> otherwise, yes, i'd normally just reassign the parameters.
>
> At this point I believe this patch is ready to commit.  I'd reword
> the docstring to make it simpler but that is a minor detail and
> something that is easy to change in a future commit.

I agree the patch is ready.