The user has no credentials before the CreateUser Web service is called, so there is no specific security policy recommendation for it.