generated user and favorite model and user and favorite controller and protected from forgery