Sanitize data returned from user API endpoint
Sanitize data returned from user API endpoint

To prevent leaking potentially private information, I am making this
endpoint only return the ID and name for all users, plus the email
address if the request is submitted by the currently logged in user.

lencioni/gift-thing,lencioni/gift-thing