entities should be refreshed by primary key to avoid a security issue (see the Symfony 2.0.6 release changing it for the EntityUserProvider)