diff --git a/hydro/handler/user.js b/hydro/handler/user.js
index 28779dd9f..75794f010 100644
--- a/hydro/handler/user.js
+++ b/hydro/handler/user.js
@@ -39,7 +39,7 @@ class UserLoginHandler extends Handler {
     }) {
         const udoc = await user.getByUname(domainId, uname);
         if (!udoc) throw new LoginError(uname);
-        if (udoc) udoc.checkPassword(password);
+        udoc.checkPassword(password);
         await user.setById(udoc._id, { loginat: new Date(), loginip: this.request.ip });
         if (udoc.priv === PRIV_NONE) throw new BlacklistedError(uname);
         this.session.uid = udoc._id;
diff --git a/hydro/model/setting.js b/hydro/model/setting.js
index 63d71eca0..93d5c9db0 100644
--- a/hydro/model/setting.js
+++ b/hydro/model/setting.js
@@ -22,10 +22,10 @@ const SYSTEM_SETTINGS_BY_KEY = {};
 
 const Setting = (
     family, key, range = null,
-    value = null, ui = 'text', name = '',
-    desc = '', hidden = false,
+    value = null, type = 'text', name = '',
+    desc = '', hidden = false, disabled = false,
 ) => ({
-    family, key, range, value, ui, name, desc, hidden,
+    family, key, range, value, type, name, desc, hidden, disabled,
 });
 
 const PreferenceSetting = (...settings) => {
@@ -101,13 +101,13 @@ SystemSetting(
     Setting('setting_smtp', 'smtp.host', null, null, 'text', 'SMTP Server Host'),
     Setting('setting_smtp', 'smtp.port', null, 465, 'number', 'SMTP Server Port'),
     Setting('setting_smtp', 'smtp.from', null, null, 'text', 'Mail From'),
-    Setting('setting_smtp', 'smtp.secure', null, false, 'checkbox', 'SSL'),
+    Setting('setting_smtp', 'smtp.secure', null, false, 'boolean', 'SSL'),
     Setting('setting_server', 'server.worker', null, 1, 'number', 'Server Workers Number'),
     Setting('setting_server', 'server.hostname', null, null, 'text', 'Server Hostname'),
     Setting('setting_server', 'server.host', null, null, 'text', 'Server Host'),
     Setting('setting_server', 'server.url', null, null, 'text', 'Server BaseURL'),
     Setting('setting_server', 'server.port', null, 8888, 'number', 'Server Port'),
-    Setting('setting_server', 'server.log', null, false, 'checkbox', 'Disable Access Log'),
+    Setting('setting_server', 'server.log', null, false, 'boolean', 'Disable Access Log'),
     Setting('setting_oauth', 'oauth.githubappid', null, null, 'text', 'Github Oauth AppID'),
     Setting('setting_oauth', 'oauth.githubsecret', null, null, 'text', 'Github Oauth Secret'),
     Setting('setting_oauth', 'oauth.googleappid', null, null, 'text', 'Google Oauth ClientID'),
diff --git a/hydro/model/token.js b/hydro/model/token.js
index 9a9ae8af4..8985b19aa 100644
--- a/hydro/model/token.js
+++ b/hydro/model/token.js
@@ -53,7 +53,7 @@ async function get(tokenId, tokenType, doThrow = true) {
  */
 async function update(tokenId, tokenType, expireSeconds, data) {
     const now = new Date();
-    const res = await coll.updateOne(
+    const res = await coll.findOneAndUpdate(
         { _id: tokenId, tokenType },
         {
             $set: {
@@ -63,6 +63,7 @@ async function update(tokenId, tokenType, expireSeconds, data) {
                 tokenType,
             },
         },
+        { returnOriginal: false },
     );
     return res.value;
 }
diff --git a/templates/partials/setting.html b/templates/partials/setting.html
index 9b74b57fd..2a9bd6736 100644
--- a/templates/partials/setting.html
+++ b/templates/partials/setting.html
@@ -6,60 +6,67 @@
   <div class="section__body">
   {% for setting in family_settings %}
   {% if not setting.hidden %}
-  {% if setting.ui == 'text' or setting.ui == 'password' or setting.ui == 'number' %}
+  {% if setting.type == 'text' or setting.type == 'password' or setting.type == 'number' %}
     {{ form.form_text({
-          type:setting.ui,
+          type:setting.type,
           label:setting.name,
           help_text:setting.desc,
           name:setting.key,
-          value:current[setting.key] or setting.value
+          value:current[setting.key] or setting.value,
+          disabled:setting.disabled
         }) }}
-  {% elif setting.ui == 'select' %}
+  {% elif setting.type == 'select' %}
     {{ form.form_select({
           options:setting.range,
           label:setting.name,
           help_text:setting.desc,
           name:setting.key,
-          value:current[setting.key] or setting.value
+          value:current[setting.key] or setting.value,
+          disabled:setting.disabled
         }) }}
-  {% elif setting.ui == 'radio' %}
+  {% elif setting.type == 'radio' %}
     {{ form.form_radio({
           options:setting.range,
           label:setting.name,
           help_text:setting.desc,
           name:setting.key,
-          value:current[setting.key] or setting.value
+          value:current[setting.key] or setting.value,
+          disabled:setting.disabled
         }) }}
-  {% elif setting.ui == 'image_radio' %}
+  {% elif setting.type == 'image_radio' %}
     {{ form.form_image_radio({
           options:setting.range,
           image_class:setting.image_class,
           label:setting.name,
           help_text:setting.desc,
           name:setting.key,
-          value:current[setting.key] or setting.value
+          value:current[setting.key] or setting.value,
+          disabled:setting.disabled
         }) }}
-  {% elif setting.ui == 'textarea' %}
-    {{ form.form_textarea({
-          label:setting.name,
-          help_text:setting.desc,
-          name:setting.key,
-          value:current[setting.key] or setting.value
-        }) }}
-  {% elif setting.ui == 'markdown' %}
+  {% elif setting.type == 'textarea' %}
     {{ form.form_textarea({
           label:setting.name,
           help_text:setting.desc,
           name:setting.key,
           value:current[setting.key] or setting.value,
-          markdown:true
+          disabled:setting.disabled
         }) }}
-  {% elif setting.ui == 'checkbox' %}
+  {% elif setting.type == 'markdown' %}
+    {{ form.form_textarea({
+          label:setting.name,
+          help_text:setting.desc,
+          name:setting.key,
+          value:current[setting.key] or setting.value,
+          markdown:true,
+          disabled:setting.disabled
+        }) }}
+  {% elif setting.type == 'boolean' %}
     {{ form.form_checkbox({
           label:setting.name,
           help_text:setting.desc,
           name:setting.key,
-          value:current[setting.key] or setting.value
+          value:current[setting.key] or setting.value,
+          disabled:setting.disabled
     })}}
   {% endif %}
   {% endif %}