security: testing the wrong variable in create_by_name()