new user can be created. has no validation