added /session/authenticate
GET /users
POST /users