change user info change url, fix security problem.