audit uuid; bug fixes; internal calls to api

api/users/get_user now calls api/users/_get_user which can be
used by any internal method. Will be using this pattern elsewhere
as well.

fixed bug rewrite where callback wasn't being called.

audit entries now all have uuids

sanitize user creates a copy before sanitizing - fixing data-corrupting bug