restrict access to admins in user controller
added assets model