move the key-add and sudo pieces out of the "if user already exists" check
so that they are always run (in case of error or bad change on server)