Permissions on non-owned database

Hello

I have a strange problem and cannot realize is it really true.
There are 2 problems - first one is that any user can create table
(or probably any other object) in non-owned database.
The second is that any postgres user can create object in template1
database. I've used 7.0.2 and never seen such problems.
The postgres 7.1.3 was installed from scratch and nothing was changed
from default configuration - I've only created 2 users + one db and
check the situation.

Can somebody tell me what may be a problem here ?

thanks,
--
Dimitry