Exactly, you should login as USER to grant permission of the users objects