add autorization for users controller