removeUser added and minor security fix