REST handler for users