provisionPrimaryUser does not need disclosable attrs