error fix - add user update action to allowed route
dry up user controller