Fixes for CODAP API
Add option to automatically create unknown users

This is only useful now before we have a SSO-oriented way to create
users and is totally unsafe/unwise.