POST /user with an existing user should throw a 409, not a 401