Add proper checks to users controller