Fixed potential security hole in system controller; clone and join shouldn't really use POST data as user id; instead, using $this->data['login']->user_id