added private attributes to user controller