- add possibility to grant an external user. - route /api/users/{id} added (rate limited for security) - security: start route limitation for external users ex: they must not browse /api/users/{id} nor addressbook