create users works needs validation