spec for users show api call