must be logged in to hit users controller