fix invalidateUser - modifying _id is forbidden