move user_hash into controller