RFP change user

Added CRUD functionality for User Class
Should we also require authentication for destroy?