user POST for /api/users/approve