remove an unnecessary isprotecting field in user.go
 remove an unnecessary isprotecting field in user.go, & make add_fsm use user.ProtectTimeout field