add /users/:id route, abstract apiKey check