make component registry be per-user; fix res.json to use right signature