fixed user route to use req.query insteady of req.body