The /users-endpoint should return different information based on permissions of requesting entity

[zergar]

Is your feature request related to a problem? Please describe.
For different applications like initiating money transfers it would be useful, if any logged-in user could fetch a list of usernames only consisting of username, display_name, and id.

Describe the solution you'd like
/users should return a different json-array representing an user only with their isername, display_name, and id, if the requesting entity is logged in and is not an administrator.

Describe alternatives you've considered

Additional context

[phiphi282]

There is an open pull request for authorization, this behavior should already be implemented there.