Don't permit user.index_all by default

Showing user.index_all has the unintended side effect of leaking
information about hidden instances. Furthermore the URL isn't exposed
through the UI anyway.