implemented admin role
api/users gets list of users, admin access only
admin/users page added with correct authorization check