make User CRUD pages work (but not auto-tested yet)
* add Authority field to create/edit/list/show page
* remove password field from list page
* @Secured(['ROLE_ADMIN']) other than list/show page
* modify delete() to work with UserAuthority join table