add restrict user in controller