modified users_controller with restrictions