Added use strict and returned 401 if a user tried creating a user and they were not an admin