No need to have avoid timing side-channel attack in user_add. We're just going to tell you if the user already exists anyway.