allow any authentic user to pull the list of users from GET /api/user and also add a check for superuser perms on the send_invite endpoint because that's only meant for admins.

* set the absolute limit up to just over 1m rows, which is the max Excel allows.
* allow query execution callers to specify their own :max-results and :max-results-bare-rows values so that we can contextually constrain the result sizes.  this allows us to easily have the api allow 10k results, a pulse allow 500 results, and a CSV download to allow 1m results.

add a new function for `(set-all [map])` in the settings model and add a new api endpoint for PUT /api/setting/ which allows applying multiple settings in a single api call.