diff --git a/src/routes/test/oauth2-test.js b/src/routes/test/oauth2-test.js
index b665c474f..e3667fb2c 100644
--- a/src/routes/test/oauth2-test.js
+++ b/src/routes/test/oauth2-test.js
@@ -219,7 +219,7 @@ describe('OAuth2', function () {
                 appdb.add.bind(null, APP_2.id, APP_2.appStoreId, APP_2.manifest, APP_2.location, APP_2.domain, APP_2.portBindings, APP_2),
                 appdb.add.bind(null, APP_3.id, APP_3.appStoreId, APP_3.manifest, APP_3.location, APP_3.domain, APP_3.portBindings, APP_3),
                 function (callback) {
-                    users.create(USER_0.username, USER_0.password, USER_0.email, USER_0.displayName, null /* source */, function (error, userObject) {
+                    users.create(USER_0.username, USER_0.password, USER_0.email, USER_0.displayName, { }, null /* source */, function (error, userObject) {
                         expect(error).to.not.be.ok();
 
                         // update the global objects to reflect the new user id
diff --git a/src/routes/users.js b/src/routes/users.js
index 17b136a2c..eb98472bf 100644
--- a/src/routes/users.js
+++ b/src/routes/users.js
@@ -38,7 +38,7 @@ function create(req, res, next) {
     var username = 'username' in req.body ? req.body.username : null;
     var displayName = req.body.displayName || '';
 
-    users.create(username, password, email, displayName, auditSource(req), { invitor: req.user, sendInvite: sendInvite }, function (error, user) {
+    users.create(username, password, email, displayName, { invitor: req.user, sendInvite: sendInvite }, auditSource(req), function (error, user) {
         if (error && error.reason === UsersError.BAD_FIELD) return next(new HttpError(400, error.message));
         if (error && error.reason === UsersError.ALREADY_EXISTS) return next(new HttpError(409, error.message));
         if (error) return next(new HttpError(500, error));
diff --git a/src/test/ldap-test.js b/src/test/ldap-test.js
index a4d57a0cb..04f437f3a 100644
--- a/src/test/ldap-test.js
+++ b/src/test/ldap-test.js
@@ -115,7 +115,7 @@ function setup(done) {
             });
         },
         function (callback) {
-            users.create(USER_1.username, USER_1.password, USER_1.email, USER_0.displayName, AUDIT_SOURCE, { invitor: USER_0 }, function (error, result) {
+            users.create(USER_1.username, USER_1.password, USER_1.email, USER_0.displayName, { invitor: USER_0 }, AUDIT_SOURCE, function (error, result) {
                 if (error) return callback(error);
 
                 USER_1.id = result.id;
@@ -124,7 +124,7 @@ function setup(done) {
             });
         },
         function (callback) {
-            users.create(USER_2.username, USER_2.password, USER_2.email, USER_0.displayName, AUDIT_SOURCE, { invitor: USER_0 }, function (error, result) {
+            users.create(USER_2.username, USER_2.password, USER_2.email, USER_0.displayName, { invitor: USER_0 }, AUDIT_SOURCE, function (error, result) {
                 if (error) return callback(error);
 
                 USER_2.id = result.id;
diff --git a/src/test/users-test.js b/src/test/users-test.js
index 01d8bed93..bb1bcea5f 100644
--- a/src/test/users-test.js
+++ b/src/test/users-test.js
@@ -119,7 +119,7 @@ describe('User', function () {
         after(cleanupUsers);
 
         it('fails due to short password', function (done) {
-            users.create(USERNAME, 'Fo$%23', EMAIL, DISPLAY_NAME, AUDIT_SOURCE, function (error, result) {
+            users.create(USERNAME, 'Fo$%23', EMAIL, DISPLAY_NAME, { }, AUDIT_SOURCE, function (error, result) {
                 expect(error).to.be.ok();
                 expect(result).to.not.be.ok();
                 expect(error.reason).to.equal(UsersError.BAD_FIELD);
@@ -129,7 +129,7 @@ describe('User', function () {
         });
 
         it('fails due to reserved username', function (done) {
-            users.create('admin', PASSWORD, EMAIL, DISPLAY_NAME, AUDIT_SOURCE, function (error, result) {
+            users.create('admin', PASSWORD, EMAIL, DISPLAY_NAME, { }, AUDIT_SOURCE, function (error, result) {
                 expect(error).to.be.ok();
                 expect(result).to.not.be.ok();
                 expect(error.reason).to.equal(UsersError.BAD_FIELD);
@@ -139,7 +139,7 @@ describe('User', function () {
         });
 
         it('fails due to invalid username', function (done) {
-            users.create('moo+daemon', PASSWORD, EMAIL, DISPLAY_NAME, AUDIT_SOURCE, function (error, result) {
+            users.create('moo+daemon', PASSWORD, EMAIL, DISPLAY_NAME, { }, AUDIT_SOURCE, function (error, result) {
                 expect(error).to.be.ok();
                 expect(result).to.not.be.ok();
                 expect(error.reason).to.equal(UsersError.BAD_FIELD);
@@ -149,7 +149,7 @@ describe('User', function () {
         });
 
         it('fails due to short username', function (done) {
-            users.create('', PASSWORD, EMAIL, DISPLAY_NAME, AUDIT_SOURCE, function (error, result) {
+            users.create('', PASSWORD, EMAIL, DISPLAY_NAME, { }, AUDIT_SOURCE, function (error, result) {
                 expect(error).to.be.ok();
                 expect(result).to.not.be.ok();
                 expect(error.reason).to.equal(UsersError.BAD_FIELD);
@@ -159,7 +159,7 @@ describe('User', function () {
         });
 
         it('fails due to long username', function (done) {
-            users.create(new Array(257).fill('Z').join(''), PASSWORD, EMAIL, DISPLAY_NAME, AUDIT_SOURCE, function (error, result) {
+            users.create(new Array(257).fill('Z').join(''), PASSWORD, EMAIL, DISPLAY_NAME, { }, AUDIT_SOURCE, function (error, result) {
                 expect(error).to.be.ok();
                 expect(result).to.not.be.ok();
                 expect(error.reason).to.equal(UsersError.BAD_FIELD);
@@ -169,7 +169,7 @@ describe('User', function () {
         });
 
         it('fails due to reserved app pattern', function (done) {
-            users.create('maybe.app', PASSWORD, EMAIL, DISPLAY_NAME, AUDIT_SOURCE, function (error, result) {
+            users.create('maybe.app', PASSWORD, EMAIL, DISPLAY_NAME, { }, AUDIT_SOURCE, function (error, result) {
                 expect(error).to.be.ok();
                 expect(result).to.not.be.ok();
                 expect(error.reason).to.equal(UsersError.BAD_FIELD);
@@ -191,31 +191,8 @@ describe('User', function () {
             });
         });
 
-        it('fails because of invalid BAD_FIELD', function (done) {
-            expect(function () {
-                users.create(EMAIL, {}, function () {});
-            }).to.throwException();
-            expect(function () {
-                users.create(12345, PASSWORD, EMAIL, function () {});
-            }).to.throwException();
-            expect(function () {
-                users.create(USERNAME, PASSWORD, EMAIL, {});
-            }).to.throwException();
-            expect(function () {
-                users.create(USERNAME, PASSWORD, EMAIL, {}, function () {});
-            }).to.throwException();
-            expect(function () {
-                users.create(USERNAME, PASSWORD, EMAIL, {});
-            }).to.throwException();
-            expect(function () {
-                users.create(USERNAME, PASSWORD, EMAIL, false, null, 'foobar');
-            }).to.throwException();
-
-            done();
-        });
-
         it('fails because user exists', function (done) {
-            users.create(USERNAME, PASSWORD, EMAIL, DISPLAY_NAME, AUDIT_SOURCE, function (error, result) {
+            users.create(USERNAME, PASSWORD, EMAIL, DISPLAY_NAME, { }, AUDIT_SOURCE, function (error, result) {
                 expect(error).to.be.ok();
                 expect(result).not.to.be.ok();
                 expect(error.reason).to.equal(UsersError.ALREADY_EXISTS);
@@ -225,7 +202,7 @@ describe('User', function () {
         });
 
         it('fails because password is empty', function (done) {
-            users.create(USERNAME, '', EMAIL, DISPLAY_NAME, AUDIT_SOURCE, function (error, result) {
+            users.create(USERNAME, '', EMAIL, DISPLAY_NAME, { }, AUDIT_SOURCE, function (error, result) {
                 expect(error).to.be.ok();
                 expect(result).not.to.be.ok();
                 expect(error.reason).to.equal(UsersError.BAD_FIELD);
@@ -239,7 +216,7 @@ describe('User', function () {
             maildb.update(DOMAIN_0.domain, { enabled: true }, function (error) {
                 expect(error).not.to.be.ok();
 
-                users.create(USERNAME_1, PASSWORD_1, EMAIL_1, DISPLAY_NAME_1, AUDIT_SOURCE, { sendInvite: true }, function (error, result) {
+                users.create(USERNAME_1, PASSWORD_1, EMAIL_1, DISPLAY_NAME_1, { sendInvite: true }, AUDIT_SOURCE, function (error, result) {
                     expect(error).not.to.be.ok();
                     expect(result).to.be.ok();
                     expect(result.username).to.equal(USERNAME_1.toLowerCase());
@@ -690,7 +667,7 @@ describe('User', function () {
         it('make second user admin succeeds', function (done) {
 
             var invitor = { username: USERNAME, email: EMAIL };
-            users.create(user1.username, user1.password, user1.email, DISPLAY_NAME, AUDIT_SOURCE, { invitor: invitor }, function (error, result) {
+            users.create(user1.username, user1.password, user1.email, DISPLAY_NAME, { invitor: invitor }, AUDIT_SOURCE, function (error, result) {
                 expect(error).to.not.be.ok();
                 expect(result).to.be.ok();
 
@@ -743,7 +720,7 @@ describe('User', function () {
             };
 
             var invitor = { username: USERNAME, email: EMAIL };
-            users.create(user1.username, user1.password, user1.email, DISPLAY_NAME, AUDIT_SOURCE, { invitor: invitor }, function (error, result) {
+            users.create(user1.username, user1.password, user1.email, DISPLAY_NAME, { invitor: invitor }, AUDIT_SOURCE, function (error, result) {
                 expect(error).to.eql(null);
                 expect(result).to.be.ok();
 
diff --git a/src/users.js b/src/users.js
index 751e1854e..5af018f2b 100644
--- a/src/users.js
+++ b/src/users.js
@@ -133,21 +133,17 @@ function removePrivateFields(user) {
     return _.pick(user, 'id', 'username', 'email', 'fallbackEmail', 'displayName', 'groupIds', 'admin');
 }
 
-function create(username, password, email, displayName, auditSource, options, callback) {
+function create(username, password, email, displayName, options, auditSource, callback) {
     assert(username === null || typeof username === 'string');
     assert(password === null || typeof password === 'string');
     assert.strictEqual(typeof email, 'string');
     assert.strictEqual(typeof displayName, 'string');
+    assert(options && typeof options === 'object');
     assert.strictEqual(typeof auditSource, 'object');
 
-    if (typeof options === 'function') {
-        callback = options;
-        options = null;
-    }
-
-    var invitor = options && options.invitor ? options.invitor : null,
-        sendInvite = options && options.sendInvite ? true : false,
-        owner = options && options.owner ? true : false;
+    var invitor = options.invitor || null,
+        sendInvite = !!options.sendInvite,
+        owner = !!options.owner;
 
     var error;
 
@@ -522,7 +518,7 @@ function createOwner(username, password, email, displayName, auditSource, callba
             // we proceed if it already exists so we can re-create the owner if need be
             if (error && error.reason !== DatabaseError.ALREADY_EXISTS) return callback(new UsersError(UsersError.INTERNAL_ERROR, error));
 
-            create(username, password, email, displayName, auditSource, { owner: true }, function (error, user) {
+            create(username, password, email, displayName, { owner: true }, auditSource, function (error, user) {
                 if (error) return callback(error);
 
                 groups.addMember(constants.ADMIN_GROUP_ID, user.id, function (error) {