add private to user.rb