decoupled user creation from HTTP