don't disqualify duplicate user unless step > 2