remove unused var
fix getAll() removing password from original users Array
add a middleware function to check group belonging