Allow set user back to current database instance

I did some unittest, i create 2 users (ouser/puser) in OUser table, login to database with each user and create one restricted record for each user after login. After user created, ouser rid is #10:2, puser rid is #10:3

Delete user and create same 2 user again from OUser table, and login to each user and create restricted record again (before create i will delete old record). This time after user created, ouser rid is #10:3, puser rid is #10:2

(I am user Restful API to create record)

check the record i created by ouser, _allow field is still #10:2
check the record i created by puser, _allow field is still #10:3

No matter how many time i tried, and also print out the user for current database instance by 
ODatabaseRecordThreadLocal.INSTANCE.get().getUser() before insert. Keep getting old user rid. But after i restart database, user rid is correct. Following is my unittest code sample

def "create ouser and pusesr" () {
    setup : 
		ODatabaseDocumentTx db = database.openDatabase()
                def user1 = "ouser"
		def user2 = "puser"
		def password = "password"
    when : 
                deleteUser(user1, db)
                deleteUser(user2, db)
                createUser(user1, password, db)
                createUser(user2, password, db)
     then :
		notThrown Exception
		db.close()
}

def "create restricted document by ouser" () {
     setup : 
		ODatabaseDocumentTx db = database.openDatabase()
		def username = "ouser"
		def password = "password"
                def List<ODocument> result
     when : 
		deleteRecord(db)
                //create by Restful API
		createRecord("http://localhost:2480/function/db/create/0", value1, value2, username, password);
		result = query(db)

then :
		notThrown Exception
		result != null
		result.size() == 1
		ODocument doc = result.get(0)
		doc.field("@rid") != null
		checkRid(doc.getIdentity().toString()) == true
		ODocument userDoc = db.getMetadata().getSecurity().getUser(username).getDocument()
		ODocument field = doc.field("_allow")
		field != null
		field.equals(userDoc) //Error, login user and _allow are not equal, and happend in second run
		doc.field("updated") != null
		db.close()
}

My change,

      For Http Restful call, after authentication, return current successful login user, and store in OHttpRequest, then do the check, if 2 user are different, overwrite with login user.