docs: def handle_put_user(self, req):
          """Handles the PUT v2/<account>/<user> call for adding a user to an
          account.
  
          X-Auth-User-Key represents the user's key (url encoded),
          - OR -
          X-Auth-User-Key-Hash represents the user's hashed key (url encoded),
          X-Auth-User-Admin may be set to `true` to create an account .admin, and
          X-Auth-User-Reseller-Admin may be set to `true` to create a
          .reseller_admin.
  
          Creating users
          **************
          Can only be called by an account .admin unless the user is to be a
          .reseller_admin, in which case the request must be by .super_admin.
  
          Changing password/key
          *********************
          1) reseller_admin key can be changed by super_admin and by himself.
          2) admin key can be changed by any admin in same account,
             reseller_admin, super_admin and himself.
          3) Regular user key can be changed by any admin in his account,
             reseller_admin, super_admin and himself.
  
          :param req: The swob.Request to process.
          :returns: swob.Response, 2xx on success.
          """
          # Validate path info
          account = req.path_info_pop()
          user = req.path_info_pop()
          key = unquote(req.headers.get('x-auth-user-key', ''))
          key_hash = unquote(req.headers.get('x-auth-user-key-hash', ''))
          admin = req.headers.get('x-auth-user-admin') == 'true'
          reseller_admin = \
              req.headers.get('x-auth-user-reseller-admin') == 'true'
          if reseller_admin:
              admin = True
          if req.path_info or not account or account[0] == '.' or not user or \
                  user[0] == '.' or (not key and not key_hash):
              return HTTPBadRequest(request=req)
          if key_hash:
              try:
                  swauth.authtypes.validate_creds(key_hash)
              except ValueError:
                  return HTTPBadRequest(request=req)
  
          user_arg = account + ':' + user
          if reseller_admin:
              if not self.is_super_admin(req) and\
                      not self.is_user_changing_own_key(req, user_arg):
                          return self.denied_response(req)
          elif not self.is_account_admin(req, account) and\
                  not self.is_user_changing_own_key(req, user_arg):
                      return self.denied_response(req)
  
          path = quote('/v1/%s/%s' % (self.auth_account, account))
          resp = self.make_pre_authed_request(
              req.environ, 'HEAD', path).get_response(self.app)
          if resp.status_int // 100 != 2:
              raise Exception('Could not retrieve account id value: %s %s' %
                              (path, resp.status))
          headers = {'X-Object-Meta-Account-Id':
                     resp.headers['x-container-meta-account-id']}
          # Create the object in the main auth account (this object represents
          # the user)
          path = quote('/v1/%s/%s/%s' % (self.auth_account, account, user))
          groups = ['%s:%s' % (account, user), account]
          if admin:
              groups.append('.admin')
          if reseller_admin:
              groups.append('.reseller_admin')
          auth_value = key_hash or self.auth_encoder().encode(key)
          resp = self.make_pre_authed_request(
              req.environ, 'PUT', path,
              json.dumps({'auth': auth_value,
                          'groups': [{'name': g} for g in groups]}),
              headers=headers).get_response(self.app)
          if resp.status_int == 404:
              return HTTPNotFound(request=req)
          if resp.status_int // 100 != 2:
              raise Exception('Could not create user object: %s %s' %
                              (path, resp.status))
          return HTTPCreated(request=req)