Update users api canThis context

No existing issue (noticed while I was updating settings api calls)

- Update api.users methods to pass the whole context to canThis instead of just this.user

This should prevent any issues in the future when apps or internal requests may have different permissions.   I think we also talked about eventually removing this legacy support for passing just a user id to `canThis()`.