security fix for signup