authentication, authorization, and user index
added destroy