locking down users controller to superusers only