maybe should inject new user directly into db myself...