add all user list, developer-only auth