diff --git a/internal/server/usermanager/controller.go b/internal/server/usermanager/controller.go
index d4854b4..20bdef0 100644
--- a/internal/server/usermanager/controller.go
+++ b/internal/server/usermanager/controller.go
@@ -47,7 +47,8 @@ func (c *controller) HandleRequest(req []byte) ([]byte, error) {
 	if err == ErrInvalidMac {
 		log.Printf("!!!CONTROL MESSAGE AND HMAC MISMATCH!!!\n raw request:\n%x\ndecrypted msg:\n%x", req, plain)
 		return nil, err
-	} else {
+	} else if err != nil {
+		log.Println(err)
 		return c.respond([]byte(err.Error())), nil
 	}
 
diff --git a/internal/server/usermanager/user.go b/internal/server/usermanager/user.go
index 12f774e..bdbb6f7 100644
--- a/internal/server/usermanager/user.go
+++ b/internal/server/usermanager/user.go
@@ -26,9 +26,7 @@ type User struct {
 
 	arrUID [32]byte
 
-	// TODO: use pointer here instead because we don't want to accidentally read
-	// UserInfo's Credits?
-	UserInfo
+	*UserInfo
 
 	valve *mux.Valve
 
@@ -36,7 +34,7 @@ type User struct {
 	sessions  map[uint32]*mux.Session
 }
 
-func MakeUser(up *Userpanel, uinfo UserInfo) *User {
+func MakeUser(up *Userpanel, uinfo *UserInfo) *User {
 	// this instance of valve is shared across ALL sessions of a user
 	valve := mux.MakeValve(uinfo.UpRate, uinfo.DownRate, &uinfo.UpCredit, &uinfo.DownCredit)
 	u := &User{
diff --git a/internal/server/usermanager/userpanel.go b/internal/server/usermanager/userpanel.go
index 27e5863..ce7e976 100644
--- a/internal/server/usermanager/userpanel.go
+++ b/internal/server/usermanager/userpanel.go
@@ -124,7 +124,7 @@ func (up *Userpanel) GetAndActivateUser(UID []byte) (*User, error) {
 		up.activeUsersM.Unlock()
 		return nil, err
 	}
-	u := MakeUser(up, uinfo)
+	u := MakeUser(up, &uinfo)
 	up.activeUsers[arrUID] = u
 	up.activeUsersM.Unlock()
 	return u, nil