update Users controller with admin rights code