client: fix possible null dereference in create

There are two paths that jump to the out label for which 'in' can be
NULL and outp can be non-NULL.  For those cases we want to fill in the
caller's pointer value (they asked for it) but we clearly cannot take
a reference.

Backport: emperor, dumpling
Signed-off-by: Sage Weil <sage@inktank.com>
Merge pull request #1302 from ceph/wip-create-null

client: fix possible null dereference in create

Reviewed-by: Greg Farnum <greg@inktank.com>