As a followup to (linked) database cleanup issue there were a couple of problems caused by the autoCreate option being included in the URI. Main points:

• autoCreate should allow to create new users only for local, authenticated users.
• with autoCreate it's impossible to delete users as it calls to getUID, which… creates the user.

(this is an "epic" / user story type of task and actual implementation task should be created one course of action is determined)