add POST create to UsersController, tests