restrict access to users controller, fix role form field not reflecting current user role