work towards unit testing
can use spring security to authorize access to specific user endpoints
updated comments
admin can access other user
merged from master