Card #226 letter @UserOnly service security, test fixes