complete user controller, update rbac usage