fix user setting security