fixed double password protection in users service, fixed uninitialized db in security