add REST controller for /user/list