add correct_user method to Users controller