not much to do for user-service yet, but more consistent to have a service shield these actions from the controller