Added POST /user 'creator' and 'admin' validations, according to current session.