Project Manager and above can see users tab.

Fixes #434 
should :only-roles be a set here rather than a vector to avoid the ```(into #{}...)``` below?