only the admin can list users
undo