make create_user role & tenant-aware