UsersController with admin's authorization required added