users controller scoped to sesions