mostly comment updates
added some dev host stuff to make URL helpers and mailers happier
beefing up access policy to take out repetitive code elsewhere
cleaning up exception rescue behavior in api controller
added users search routine and API, along with initial pass at tests
added search ordering with tests; added pagination tests