A default 'api user' with predictable credentials and api key was being created in the default configuration and administrator rights. As this is a security issue in default installations I have disabled the 'api' user (as it does not seem to be used anyways). Disabled the default 'user' in the process to only have a default administrator for clean installs, which can be overwritten in an externalised configuration.