moved private params of user controller to application controller to be ...

...used by clients controller, fixed edit page so that it responds to correct client when updating