update user with set instead of merge to avoid duplicates