Fix bug where any user is visible via /users/:id

Workaround, may be changed later