Refactor to use traversal instead of route patterns. This gives us the advantage of having permissions inherited by containment.
Restrict /users/ to Authenticated.