Update user_controller.rb

add acl logged in check