add client scoping to users [#4]