Update user.md

Added objects returned and permissions.  Also, changed POST in the add/remove problem set to PUT