add sign-in sign-out to user controller