fix createUserController

needed a change to userModel as this is where it will compare the 2
passwords - done this way as CBA including JsonResponse into
controller, might mess stuff up