Closing the WordPress REST API users route, then checking it with curl

A default WordPress site answers /wp-json/wp/v2/users for anyone. Two PHP filters, the routes they break, and curl checks for each.