Added /user to disallowed urls