fix controllers in routes and protected in users controller