fix flaw in newUser API