user listing without direct db access