Add scoped access and policy checks to user controller