add permission check to GET /user/:name

the currently executing subject is now exposed through the base rest controller