add scope authorisation to user controller