Added OData support and locked down the Users controller