removed csrf, updated users controller for whitelistings vars