user creation - allow when registration open