code review: users controller