Multiple changes

- Added handling of 'me' as a replacement for authenticated user's id in
functions show, update and delete
- Added some notes to user resource descriptor to explain handling of
'me'
- Added meta data object to user list response
- Validate password for user now returns the user object
- Replaced req.param('name') with req.params.name or req.query.name
everywhere for clarity