add User controller and update routes