Merge pull request #3302 from wwitzel3/fix-3153

prevent non-superusers from adding orphan users

awx/api/views.py

@@ -1153,6 +1153,7 @@ class UserList(ListCreateAPIView):
 
     model = User
     serializer_class = UserSerializer
+    permission_classes = (UserPermission,)
 
     def post(self, request, *args, **kwargs):
         ret = super(UserList, self).post( request, *args, **kwargs)