deny id and user change
(minor) fix some indentation