Fix: Security fix for account_id in UsersController