api/users: add user creation via POST