fixed user controller create authentication leak