fixed bug with correct_user authorization in user controller