added blacklist field for User, adjusted controllers