GET and POST /v1/user protected by bearer token; removed user_id requirement from resource