added permissions logic to users controller