implement POST /users and GET /users