add an api endpoint to protect
migrate users table