new controller: userController so routes don't have to import users or creditlist and don't do logics.