move restrict_user to user_controller