fixes

- send method change to public
- fixed users API response status code to 403 when wrong password while logging in
- removed smarty function: user_key