Fixed. At least the code won't crash now but it's still a big security flaw if it is possible to produce a userid of dummy or something with dummy as a prefix.