finish all REST actions for UsersController, admin priviledges, and all associated tests