user provider, security