added first pass at users service. it's gross. we should rewrite it.