Add authorization for users controller