fail if id is empty string

POST /api/users/ is another API call – which will remove all users,
don't want that to happen unexpectedly!