disable the /user route