users controller - show all users, allow editing