Users api controller and model, with tests