Shouldn't this be creating a new `User`?