added validation to User controller