Improved RestCtrl (compatible changes)
and removed sensitive fields from users/list