Add a new user API for the notifier

This new endpoint is designed specifically to fill the needs of the
notifier and should not be used by other clients.

@jimabramson @nasthagiri 
Yes; the setting defines the value that the permission class checks against, and this sets the necessary header in the request.