fixes #5178 - unify API parameters and return values. User creation should not require payload wrapped with 'user' root