changes to user controller, model & routes