Oops, removed permission check from list_users endpoint.