adding users / groups via HTTP