fixed authorization around creating system.users collections #548