Add general objecte unspecific permissions to login response
Try to retrieve user list only after login or on can_browse permission
Make user list request handler an anonymous function for request