users CRUD controller updated to prevent URL twiddling