add userlist.js to handle credentials.json