changed user access parameters in controller