disable POST /rest/create-user for now