remove duplicate method in lib/controllers/users.js and prevent send fake user