add login check logic in user controller