changed the way we avoid auth checks when creating system.users #690