Added auth levels and fixed the user controller