Completed changes to user controller

I fixed the remaining bugs in the user controller. The controller now
tests for authorization before allowing users to manage other users.