users controller calendar security fix