prevent clients from creating new users