rename users api spec and put CSRF check back into users api controller