User CRUD

Ref: #2
The `as_view()` and the `staff_member_required` decoration are none of the `urls.py` business imho. I like doing that in the `views.py` file: `user_update = staff_member_required(UserUpdate.as_view())`.