fix ensure_user and controllers