routes at /user and /user/:id