Add basic user search

@houndci @cgruppioni @georgetmayorga
This is not a security risk, because you're using `?` to escape user input