can create a user using an http session