remove User.name, make User.create() transactional, shorter auth headers