validate user create/update