[#356] Remove unused user variable in user_create's auth function