removed user from unauthorised put