re-implemented /api/users and /api/groups