Although I cannot exactly reproduce the problem that you’re having, I believe that it is caused by adding the data for the new user as query parameters instead of as a body posted in the HTTP request.
With the latest (development) code of Openfire (4.7.0-SNAPSHOT) and the restAPI plugin (1.7.0-SNAPSHOT) the following curl request works as intended: