api: don't allow anonymous to list all users