fix: check max users on user creation
test: role and user limits
Due to the fact that we don't use two stage commit for ACL, we have to check all the ACL preconditions both in SQL preprocessing (as a short circuit) and in CAS (for consistency), also CAS can be called directly