user controller, create api key on user create. fix some paths