New user rest APIs

The cleaned $id needs to be added to the query's $params.  Not doing this opens up SQL injection problems.  Also, if $id is the idnumber, then please use PARAM_NOTAGS instead of PARAM_TEXT.