add username field
add 403 back
fix user tests