allow created_at field in user validation