What about the unexpected pass in the second test ?
Why can 'joe' change properties of the 'admin' user ?
(I will just remove that test for now, but would like
to make sure Unauthorized exceptions are properly
forwarded to the client.)

Yes, I'll look into a patch to the docs. Why customization.txt ?
Isn't this more about features.txt (it's an additional interface...) ?

Thanks