Redmine

I've just started using the REST API against redmine-1.3 and have an issue that non-admin users can't query the users table e.g.

http://localhost:3000/users.xml

I can understand why you can't modify users if you are non-admin, but Redmine itself lets non-admin users view the users list via pages such as http://localhost:3000/issues and adding assignee as a filtered field.

It seems strange that the REST api disallows this access. Basically I want access to the first name, last name and id for users to develop a simple app that can query issues.

Or have I missed something?

Thanks