cleanup
user#new w/ scoped mass assignment
done with auth