Fix code injection in pre-existing User model