Update users_controller.rb

Fixed minor bug in User controller (check its authorization only if @user.save is true)