add ability to request user information even for other users

in this case we don't return permission information, because that might be sensitive information