refactored controller to access via userService only.