API create user NOT SECURE