fixed security hole where users could create a local account