moved user resource controller out of login check.