More flexible add user implementation

The perm checks are now checked by the client. The framework only
exposes a method for converting json object into a data that can be
directly passed into User.create() method. This way the developer can
convert the parse the incoming data and add app specific security
checks.