add user_list
move validation to controller