fixed security bug, about missed user attributes from client