Critical security bug: modifying context.me modifies PluginContext.global.user!