secure user api for admin only

This PR does two things

 * the /user api is only authorized for users with the role "admin"
 * create a default admin user if no user found in the database (first launch)