fixed ghost user bug, and restricted actions menu on endpoints