only the create action in the user controller