test for /api/users
admin should have list
normal user should get forbidden
(without supertest-as-promise)
#544 After introducing supertest-as-promised code gets bit clear.
(more, when more includes)