add test for user controller
add json view to hide the password