make update user stuff work; clean up URLs