fix incorrect includes() arguments in users controller