can use spring security to authorize access to specific user endpoints
updated comments
admin can access other user