refactored user controller to use user security service