only create user record if user is in the org in the first place
beefed up authenticator spec