rest: fix users require for sso