It doesn't feel quite right to pass `isGlobalAdmin` or `isTenantAdmin` into the `create user` endpoint. First of all, it would only work for admins executing the create. It also starts to mix admin functionality with the general API, and we already have endpoints that allow a user to be made a tenant/global admin /cc @mrvisser @simong