GET /users has been locked down to admins only