fixed user queries with password info