clean up user controller and implement strong params