user controller with auth