moved users to db for security