Authorization

Nothing changed in API.
`GET api/users.json` => admins only
`GET api/users/1.json` => admins or himself/herself