add user-controller auth tests