Same comment as Gary's above - if we're going to break the API eventually anyway, let's leave read_only separate from opts.  Having opts be a hash in this case makes sense because it holds the optional fields for the user document (as opposed to the preference for keeping save_auth and source as formal parameters above)