user model, controller, and routes in place, need more testing