fix user security