add tests for adding user without secrets, to verify that they do come
out inactive