fix #9356 [Security] Logger should manipulate the user reloaded from provider