REST, get-user should take the :_id of the user (or the email or the username.)

I think that get-user should take the :_id of the user, optionally since also the email and the username are keys of maximal cardinality it could be possible to use also such keys.

The GET request will take as input only the :_id, the other params are not guarantee to stay the same over time, this could lead to confusion from the consumer of the API.