getUsers, shouldAllowUser