Refactor UserController#search_users

Move the SQL generation behind an intention revealing name, add tests.