wp user create: validate fields before calling wp_insert_user()

see #358