refactor the code about new submit
fix a bug about user permission defunct
fix #23, get_user will return a fresh user from database