client: fix possible null dereference in create

There are two paths that jump to the out label for which 'in' can be NULL and
outp can be non-NULL.  For those cases we want to fill in the caller's pointer
value (they asked for it) but we clearly cannot take a reference.

Backport: emperor, dumpling Signed-off-by: Sage Weil <sage@inktank.com>