show user info through /user without auth info if user!=admin
update manifest / select fields to show on api/user