API should not return any user that has a "higher" role than them (manager shouldn't be able to see sys_admin)

[devincowan]

[ergjustin]

Right now, the user's are able to view manager and sys-admin
email: iamuser@gmail.com
password: WaterDendraFlow

[devincowan]

@jscottsf to add a filter to prevent this behavior
only see things at your level or below