Improve "users" resource access

This includes tests for the ``/api/login`` endpoint.