Ok. Stupid question. Deploying it into GlassFish, I got the log warning:
WARNING: A sub-resource method, java.util.List<com.ec.deploy.model.auth.User> com.ec.deploy.rest.UserEndpoint.list(), MUST be public scoped otherwise the method is ignored|#]
Making that method public solved the problem.