I removed this for now. Do we really want to expose an API to search ALL users?

(the advantage of limiting our searches to application_users only is that apps don't need to be trusted)