added 'master' authorization to UsersController#create