we do this on attribute read since migrating all existing users is not a
feasible solution.