user: handle not existed user page access
security: remove apache shiro code at login