Support importing a XAR containing a user and documents using that author

This should be handled at the level of the security module.

We also need to support the following use case:

• Have a user with PR
• Create a document
• Remove PR for that user
• The document still has PR