1) Allow user api/save_row requests to pass through without a book ID; 2) since api/save_row for 'users' is an admin-only option, restrict to the super admin bit