fixed notification api accessing non-existing user controller