post /user has a session check and answers 409 if there's a conflict