Pretty much everything from here to line 111 should happen in the user service, not in the controller.