This is a bug. The currently logged in user is injected into controllers via a "route resolve". However I found out that after logging out and then logging in again the "user" object that's being injected is still the "old" one. The route resolve mechanism doesn't work correctly in this use case.