api, fix User.create with access_token