apply limits properly, update user properly