Completed user REST APIs

Completed user REST APIs
The `isGlobalAdmin` not being available on the `App` model throw me off initially. Maybe we could define a [virtual property](https://github.com/sequelize/sequelize/wiki/API-Reference-DataTypes#virtual) on the App model that always returns false for proper `App` instances?