user management setup. any user can add or remove any other, no roles for now. not necessary at this level.