add users model and controller, closes #1