added auth filter to users controller