User management

I think I'd rather have the index return nothing (but successfully) for users rather than returning them all, but let's leave it. The allowed? bit keeps this limited to only those who'd be able to see it anyway.