update user routes, user#show