Prevent users from viewing the list of users/groups of the system

For now all users can go to /users or /groups and dump list of system users and groups and even pending users.
This is bad. Please, add possibility to disable this permission.