diff --git a/api/router.go b/api/router.go
index 54dbb4803..b2df108cc 100644
--- a/api/router.go
+++ b/api/router.go
@@ -141,7 +141,6 @@ func Route() *mux.Router {
 
 	projectAdminAPI := authenticatedAPI.Path("/project/{project_id}").Subrouter()
 	projectAdminAPI.Use(projects.ProjectMiddleware, projects.MustBeAdmin)
-
 	projectAdminAPI.Methods("PUT").HandlerFunc(projects.UpdateProject)
 	projectAdminAPI.Methods("DELETE").HandlerFunc(projects.DeleteProject)
 
@@ -149,7 +148,7 @@ func Route() *mux.Router {
 	projectAdminUsersAPI.Use(projects.ProjectMiddleware, projects.MustBeAdmin)
 	projectAdminUsersAPI.Path("/users").HandlerFunc(projects.AddUser).Methods("POST")
 
-	projectUserManagement := projectAdminAPI.PathPrefix("/users").Subrouter()
+	projectUserManagement := projectAdminUsersAPI.PathPrefix("/users").Subrouter()
 	projectUserManagement.Use(projects.UserMiddleware)
 
 	projectUserManagement.HandleFunc("/{user_id}", projects.GetUsers).Methods("GET", "HEAD")
@@ -157,7 +156,7 @@ func Route() *mux.Router {
 	projectUserManagement.HandleFunc("/{user_id}/admin", projects.MakeUserAdmin).Methods("DELETE")
 	projectUserManagement.HandleFunc("/{user_id}", projects.RemoveUser).Methods("DELETE")
 
-	projectKeyManagement := projectAdminAPI.PathPrefix("/keys").Subrouter()
+	projectKeyManagement := projectAdminUsersAPI.PathPrefix("/keys").Subrouter()
 	projectKeyManagement.Use(projects.KeyMiddleware)
 
 	projectKeyManagement.HandleFunc("/{key_id}", projects.GetKeys).Methods("GET", "HEAD")
diff --git a/api/users.go b/api/users.go
index 9a5d4930c..121dc3fbb 100644
--- a/api/users.go
+++ b/api/users.go
@@ -39,7 +39,8 @@ func addUser(w http.ResponseWriter, r *http.Request) {
 	user.Created = db.GetParsedTime(time.Now())
 
 	if err := db.Mysql.Insert(&user); err != nil {
-		panic(err)
+		log.Warn(editor.Username + " is not created: " + err.Error())
+		w.WriteHeader(http.StatusBadRequest)
 	}
 
 	util.WriteJSON(w, http.StatusCreated, user)