fixed bug in users controller with undefined 'user' in params