api: fix user validation