apply haml
permission for user controller and leave request + leave request types