user.create now assigns the ROLE_USER