diff --git a/lib/api/users.js b/lib/api/users.js
index fa5f5562..da89c935 100644
--- a/lib/api/users.js
+++ b/lib/api/users.js
@@ -80,6 +80,8 @@ module.exports = (db, server, userHandler) => {
                     name: true,
                     address: true,
                     storageUsed: true,
+                    forward: true,
+                    targetUrl: true,
                     quota: true,
                     disabled: true
                 },
@@ -116,6 +118,8 @@ module.exports = (db, server, userHandler) => {
                         username: userData.username,
                         name: userData.name,
                         address: userData.address,
+                        forward: userData.forward,
+                        targetUrl: userData.targetUrl,
                         quota: {
                             allowed: Number(userData.quota) || config.maxStorage * 1024 * 1024,
                             used: Math.max(Number(userData.storageUsed) || 0, 0)
@@ -137,10 +141,11 @@ module.exports = (db, server, userHandler) => {
             username: Joi.string()
                 .lowercase()
                 .regex(/^[a-z](?:\.?[a-z0-9]+)*$/, 'username')
-                .min(3)
-                .max(30)
+                .min(1)
+                .max(32)
                 .required(),
             password: Joi.string()
+                .allow(false)
                 .max(256)
                 .required(),
 
@@ -314,7 +319,7 @@ module.exports = (db, server, userHandler) => {
                         language: userData.language,
                         retention: userData.retention || false,
 
-                        enabled2fa: userData.enabled2fa,
+                        enabled2fa: Array.isArray(userData.enabled2fa) ? userData.enabled2fa : [].concat(userData.enabled2fa ? 'totp' : []),
 
                         encryptMessages: userData.encryptMessages,
                         pubKey: userData.pubKey,
diff --git a/lib/user-handler.js b/lib/user-handler.js
index 47ffc45b..1cacd4bc 100644
--- a/lib/user-handler.js
+++ b/lib/user-handler.js
@@ -528,9 +528,8 @@ class UserHandler {
 
                 // security
                 password: '', // set this later. having no password prevents login
-                asp: [], // list of application specific passwords
 
-                enabled2fa: false,
+                enabled2fa: [],
                 seed: '', // 2fa seed value
 
                 // default email address
@@ -542,6 +541,9 @@ class UserHandler {
                 recipients: data.recipients || 0,
                 forwards: data.forwards || 0,
 
+                forward: data.forward || '',
+                targetUrl: data.targetUrl || '',
+
                 // autoreply status
                 // off by default, can be changed later by user through the API
                 autoreply: false,