Ideally, this should read `Session.create_new(user)`, i.e. it auto-commits to the database.

Need to wrap it into a try/except/finally with db.session.begin/db.session.commit/db.session.rollback, ofc.