GET '/users' has a serious flaw.

Currently, getting a user by any method sends back every attribute of that user... including their password. This is mainly a reminder to myself, but if anyone else wants to take this one, be my guest.
