add permission to create User via JSON request