security fixes, user add patch