security attribute overhaul of practially all non-bindings code, we now require a user attribute