fix potential User.search SQL injection

/cc @zendesk/samson