API method: user.getAll().
Permission checking in user.create().