add permission checking for users controller