user (admin) can create another user. Lack of role checking
[#21] cancancan setup, user can create new user, roles are are taken into consideration