API requests create new user, even if user is not an admin