user controller, broken
#8