fix default headers, fix user_management_spec update, use $user instead of CONFIG['CS_USER']