fixed user to protect mass-assignment