removed auth from UsersController