DOCS-1250: Read-only users can't read system.users.

Users with read only access to the admin database can't read the
system.users collection.

I considered adding a link to [Password Hashing
Insecurity](http://docs.mongodb.org/manual/tutorial/control-access-to-mongodb-with-authentication/#password-hashing-insecurity) but it doesn't add value. I could footnote a link to [SERVER-4692](https://jira.mongodb.org/browse/SERVER-4692).

It's only fair that I patch this, since it was my support ticket that
caused it to be opened in the first place.