Security fixes for promoting users