user creation lockdown & remove es6 shiv