minor fixes in authorized_create_user()