Disallowing user listing for non-administrators

fixes #201