addresses #133 - hardens default security for user objects