fixed create user, 1234 hack