user controller fully working (tested)