This version actually works, need to tell the User controller not to run require signin for create and new