disable user create in policies, closes #6