Whoops, should not have removed expiration/lock features from User