user lists now depend on company_id too