newUser should not send checksum