only a registered user can create another user (for now)