not using uncleaned POST data for user creation any more