Fixed user controllers permissions