update user policy, add tests, fix user controller bug, minor cleanups