Authority on user controller fixed