added security back to users controller