use account instead of user as controller