user can be admin, strong params, user controller spec updated