secured the user controller