Card #226 update user security, including tests