Remove unintended side-effect

`create_user_address` modified the passed dictionary, which is
undocumented, and as far as I'm aware, unintended.
This leads to altering session data.

The problem was spotted because I call `place_order multiple` times in one
checkout process, and the `UserAddress` form would complain about the `user_id`
keyword parameter that it was passed on the second call of `place_order`.

It is fixed by copying the passed dictionary and only altering the latter.