Query the characters from the user and not directly from the Character model to increase security