Apparently, there is an ancient test that says we should allow this. Keeping the middleware, but removing its invocation

Author: david-rocca

src/controller/org.controller/index.js

@@ -1423,7 +1423,6 @@ router.post('/org/:shortname/user',
     .bail()
     .customSanitizer(toUpperCaseArray)
     .custom(isUserRole),
-  mw.rejectUnexpectedKeys(['username', 'active', 'org_uuid', 'uuid', 'name', 'authority']),
   parseError,
   parsePostParams,
   controller.USER_CREATE_SINGLE)