Check parameters in the correct place

Update doesn't require the user data, creation does.
Work around WP data handling failure
Check that we're not mangling user passwords