authorization, only create new users, unless signed in