simplified GET /user now requires group and role ids (no longer defaults to staff if roleId is not in request parameters)