Second question. Does this create a user if they do not exist? What happens if you pass a new user without password or a password that doesn't meet the complexity requirements?