Permissions fix for User controller