added "active" to user controller whitelist