Remove GET /users route

This will prevent all users from being accessed.

I figure there will eventually exist an admin app to consume this type
of data.
GET /projects

Only return projects that the authenticated and authorized user owns.
Merge branch 'feature/rm-get-all-routes' into dev