added resource-level perms to the user endpoint