fix bug user -> users
add user authorization