user_datastore.create_user has side effects on mutable inputs

[NoRePercussions]

user_datastore.create_user will mutate mutable inputs:

roles = ["Admin"]
user_datastore.create_user(username="admin", password=hash_password("admin"), roles=roles)
# now roles is [Role("Admin")] instead of ["Admin"]

This is because _prepare_create_user_args writes to roles:

flask-security/flask_security/datastore.py

Lines 208 to 214 in e387811

	def _prepare_create_user_args(self, **kwargs):
	kwargs.setdefault("active", True)
	roles = kwargs.get("roles", [])
	for i, role in enumerate(roles):
	rn = role.name if isinstance(role, self.role_model) else role
	# see if the role exists
	roles[i] = self.find_role(rn)

This can cause issues in situations where a string is always expected, e.g. in a test environment where a set of expected users may be persisted for longer than each database session (and thus the new Role values will be expired in the next session).