roughed out user resource

- user resource now limits itself to the currently authenticated user