diff --git a/ismism.ts/cli/smstst.ts b/ismism.ts/cli/smstst.ts
index ee3c88f..ec07609 100644
--- a/ismism.ts/cli/smstst.ts
+++ b/ismism.ts/cli/smstst.ts
@@ -2,9 +2,9 @@ import { smssend } from "../src/sms.ts"
 
 console.log("sending test sms")
 
-const resok = await smssend("18200145532", Math.round(Math.random() * 1000000), 78)
+const resok = await smssend("18200145532", `${Math.round(Math.random() * 1000000)}`, `${78}`)
 console.log(JSON.stringify(resok))
 
-const reserr = await smssend("1820014553-", Math.round(Math.random() * 1000000), 78)
+const reserr = await smssend("1820014553-", `${Math.round(Math.random() * 1000000)}`, `${78}`)
 console.log(JSON.stringify(reserr))
 
diff --git a/ismism.ts/src/query/user.ts b/ismism.ts/src/query/user.ts
index 5eedd87..3bc9d3f 100644
--- a/ismism.ts/src/query/user.ts
+++ b/ismism.ts/src/query/user.ts
@@ -43,6 +43,13 @@ export async function user(
 	return { ...u, soc, uname, nrec }
 }
 
+export function user_set(
+	uid: User["_id"],
+	user: Partial<User>,
+) {
+	return coll.user.updateOne({ _id: uid }, { $set: user }, { upsert: true })
+}
+
 const utc_pass_valid = new Date("2022-10-05").getTime()
 const utc_h = 60 * 60 * 1000
 const utc_d = 24 * utc_h
@@ -81,7 +88,7 @@ export async function userpass_issue(
 	}
 	return null
 }
-const uid_tst = 100
+export const uid_tst = 100
 export async function userpass_code(
 	nbr: string,
 	code: number,
diff --git a/ismism.ts/src/serve.ts b/ismism.ts/src/serve.ts
index 8e36206..31be16e 100644
--- a/ismism.ts/src/serve.ts
+++ b/ismism.ts/src/serve.ts
@@ -36,8 +36,8 @@ async function route(
 			const r = JSON.stringify(await post(f, p, b))
 			console.log(`${utc_short(Date.now())} - ${f}#${p.u?.uid ?? ""} - ${b} - ${r}`)
 			const headers: Headers = new Headers()
-			if (!p.u) headers.set("set-cookie", `pp=""; Path=/p; Secure; HttpOnly; Max-Age=0`)
-			else if (p.jwt) headers.set("set-cookie", `pp=${p.jwt}; Path=/p; Secure; HttpOnly; Max-Age=31728728`)
+			if (!p.u) headers.set("set-cookie", `pp=""; Path=/p; SameSite=Strict; Secure; HttpOnly; Max-Age=0`)
+			else if (p.jwt) headers.set("set-cookie", `pp=${p.jwt}; Path=/p; SameSite=Strict; Secure; HttpOnly; Max-Age=31728728`)
 			return new Response(r, { status: 200, headers })
 		}
 	}
diff --git a/ismism.ts/tst/post.test.ts b/ismism.ts/tst/post.test.ts
index dc26e3f..5307e1e 100644
--- a/ismism.ts/tst/post.test.ts
+++ b/ismism.ts/tst/post.test.ts
@@ -1,7 +1,7 @@
 import { assert } from "https://deno.land/std@0.163.0/testing/asserts.ts"
 import { jwk_set } from "../src/aut.ts";
 import { post, PostPass, SmsCode } from "../src/query.ts"
-import { UserPass } from "../src/query/user.ts"
+import { uid_tst, UserPass, user_set } from "../src/query/user.ts"
 
 function b(json: {
 	nbr?: string,
@@ -15,6 +15,15 @@ function b(json: {
 Deno.test("userpass", async () => {
 	const nbr = "11111111111"
 	const code = 111111
+	const rset = await user_set(uid_tst, {
+		name: "测试",
+		utc: Date.now(),
+		referer: [728],
+		intro: "this is a test",
+		nbr,
+	})
+	assert(rset.matchedCount === 1)
+
 	await jwk_set("anotherkey")
 
 	const p = {} as PostPass