updated users controller - all spec pass