don't create new staging user on REST calls
allow customAccessControl callback option passed into derby-auth initialization if you
want to define your own accessControl (otherwise, user.* locked down
to logged in user)