cleanups in securityManager, affiliation-related methods in userMapper