added strong params to Users controller