create a restricted user