add user controller and security config