user.id->user.uid
don't assume bash in spy_users.lua