fixed user create method
admins can update users