fixed user field access permissions.