so what happens here if the callers request token (api_key) does not have auth to view other users in the account?? do we end up with an exception from the ```getUsers()``` call which results in a 500 response to the caller?

It seems to me we want to explicitly handle such a case and instead return a 401... That is, if the caller does not have the authority to view other users the result is a 401 (unauthorized), not a 500.