added route protection to the users controller