Add @todo to split _resource() into multiple functions
Fix protected variable names in Users api controller

Adding _ prefixes
Add access checks for users

* Add basic view permission to users api
* Add checks for permission and scope to users api
Add access checks on individual items when GETing a collection