pulls the `query` parameter from url; removes the `user:` prefix. there must be more elegant solution than this.