[#409] Custom User model

@zzgvh (or @kardan) Could you check?

The branch has been merged with RC, so the changes on REST API permissions are already included.