updateUser method missing pwd field and a tweak of security ref page