Open Stack

Using admin token credentials with the Keystone v2.0 API and the 
openstackclient, doing this:

# openstack project create bar --enable
# openstack user create foo --project bar --enable ...

The user will be added to the project.

Using admin token credentials with the Keystone v3 API and the 
openstackclient, using the v3 policy file with is_admin:1 added just 
about everywhere, doing this:

# openstack project create bar --domain Default --enable
# openstack user create foo --domain Default --enable --project 
$project_id_of_bar ...

The user will NOT be added to the project.

Is this intentional?  Am I missing some sort of policy to allow user 
create to add the user to the given project?