bugfix: separate /db path from user API path in user module