user security update for the api