users new, show and create actions are allowed for visitor
agian restrict to access users resources to visitor