This seems a bit strange to me. We have a `getOrCreateUser` function for the purpose of external authentication strategies where a user is able to login before he actually has an account. That's not something we want for global admin users, and seems potentially risky for misuse (e.g. incorrectly creating new global admins). For global admins, we just need a function that explicitly creates a new global admin.