Completed user REST APIs

Completed user REST APIs
Can you add this instance method to the `GlobalAdmin` and `User` model:
```javascript
'toJSON': function() {
    delete this.dataValues.password;
    return this.dataValues;
}
```
That will at least remove the password hash when serializing users to json when shipping objects off to Express

FWIW, sequelize is entertaining the idea of [attribute scopes](https://github.com/sequelize/sequelize/issues/1462) to hide attributes such as passwords. If that lands soon enough, we might be able to use, rather than doing user.