fixed strong parameters in users controller