Add forbidden access check to User.class controller