I removed this functionality until we decide on a better way to restrict it...

I'm thinking trusted apps should be allowed to get all users and do whatever with them.

Non-trusted apps and normal users are maybe limited to 10-20 results (or else return an empty set)