Finish bulk of User API.
Update README.md to include unauthenticated header.