create_user now validates and returns either an error object, or a success object with the new user ID