a big one: admin can see all users, edit users, and delete users; also fix some auth problems and linking with user resource instead of current authenticated user