Actually define $users as a hash. Validate it too.