User management: Security flaws?