User management now uses User objects
Wrong join type
Implemented internal API system and tightened access to public API