more mutexing user
sha link passwords
send users in JSON