Using auth! in users controller - but permissions are still very funky