Corrected users controller to prevent access with Staff rights.