make user listing return non-private fields

this was from a time when normal users could install apps

src/routes/test/users-test.js

@@ -265,7 +265,7 @@ describe('Users API', function () {
     });
 
     describe('groups', function () {
-        it('does not list groupIds when listing users', async function () {
+        it('lists groupIds when listing users', async function () {
             const response = await superagent.get(`${serverUrl}/api/v1/users`)
                 .query({ access_token: owner.token });
 
@@ -273,7 +273,7 @@ describe('Users API', function () {
             expect(response.body.users).to.be.an('array');
 
             response.body.users.forEach(function (user) {
-                expect('groupIds' in user).to.be(false);
+                expect('groupIds' in user).to.be(true);
             });
         });
     });
@@ -299,10 +299,10 @@ describe('Users API', function () {
                 expect(user).to.be.an('object');
                 expect(user.id).to.be.ok();
                 expect(user.email).to.be.ok();
+                expect(user.role).to.be.ok();
                 if (!user.email.startsWith('unnamed')) expect(user.username).to.be.ok();
                 expect(user.password).to.not.be.ok();
                 expect(user.salt).to.not.be.ok();
-                expect(user.groupIds).to.not.be.ok();
             });
         });
     });