make sure auth in place in user controllers