add full CRUD to server's user routes

not yet tested; permissive filters in place to differentiate between administrators and users updating their credentials