diff --git a/bundles/jcr/jackrabbit-usermanager/src/main/java/org/apache/sling/jackrabbit/usermanager/impl/post/CreateUserServlet.java b/bundles/jcr/jackrabbit-usermanager/src/main/java/org/apac
index 638bcbd..ad6a69c 100644
--- a/bundles/jcr/jackrabbit-usermanager/src/main/java/org/apache/sling/jackrabbit/usermanager/impl/post/CreateUserServlet.java
+++ b/bundles/jcr/jackrabbit-usermanager/src/main/java/org/apache/sling/jackrabbit/usermanager/impl/post/CreateUserServlet.java
@@ -22,6 +22,7 @@ import java.util.Map;

 import javax.jcr.RepositoryException;
 import javax.jcr.Session;
+import javax.jcr.SimpleCredentials;
 import javax.servlet.Servlet;

 import org.apache.felix.scr.annotations.Component;
@@ -207,8 +208,12 @@ public class CreateUserServlet extends AbstractUserPostServlet implements Create
                             request.getRequestParameterMap(),
                             changes);

-        String userPath = AuthorizableResourceProvider.SYSTEM_USER_MANAGER_USER_PREFIX
-                + user.getID();
+        String userPath = AuthorizableResourceProvider.SYSTEM_USER_MANAGER_USER_PREFIX;
+        if (user != null) {
+            userPath += user.getID();
+        } else {
+            userPath += "<null user>";
+        }
         response.setPath(userPath);
         response.setLocation(externalizePath(request, userPath));
         response.setParentLocation(externalizePath(request,
@@ -310,13 +315,22 @@ public class CreateUserServlet extends AbstractUserPostServlet implements Create
                 }

                 if (useAdminSession) {
-                    //lookup the user from the user session so we can return a live object
-                    UserManager userManager2 = AccessControlUtil.getUserManager(jcrSession);
-                    Authorizable authorizable2 = userManager2.getAuthorizable(user.getID());
-                    if (authorizable2 instanceof User) {
-                        user = (User)authorizable2;
-                    } else {
-                        user = null;
+                    Session userSession = null;
+                    try {
+                        userSession = selfRegSession.impersonate(new SimpleCredentials(name,
+                                password.toCharArray()));
+                        //lookup the user from the user session so we can return a live object
+                        UserManager userManager2 = AccessControlUtil.getUserManager(userSession);
+                        Authorizable authorizable2 = userManager2.getAuthorizable(user.getID());

+                        if (authorizable2 instanceof User) {
+                            user = (User)authorizable2;
+                        } else {
+                            user = null;
+                        }
+                    } finally {
+                        if (userSession != null) {
+                            userSession.logout();
+                        }
                     }
                 }
             }