add deviceauthrequired to UsersController
Cancel routes rather than reloads