added rights validation for user model