keep number of users per account + fix security bug