Corrected Query Error In Users.php

User.php, specifically the findAll method was prefixing the first query parameter for 'roles' with '&' rather than '?'.  This was causing the query to be ignored and all users returned regardless of what roles were specified.