add user.  also not send password back to client