We're repeating this code, it seems like we should make it part of a helper somewhere.

AccountManipulator(user_bundle).createOrUpdate(user) should check that the passed user_bundle has permission.