dont sha1 the password before create_user
create_user will sha1 the password.