controller access of user edit