Deny json access

should be /users/get_users.json