Fix: create_user_and_login should accept user