Create Read only user

I created a user like this 

CREATE USER user1 WITH PASSWORD '<password>';

GRANT CONNECT ON DATABASE db1 TO user1;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO user1;

What amazes me is that when I connect using user1, I'm able to create a table and drop it. How can this be?