All CRUD on system.users is being replaced and enhanced with commands.

Note that these commands will all take a write concern as an extra field.

The point of this ticket is to ensure that a given driver's addUser / removeUser helpers work in a backward and forward compatible way. To do this your driver has to determine wether it has to use the new user manipulation commands or fall back to its existing code. Pseudo code looks something like this:

try
    userInfo = db.runCommand({'usersInfo': username})
catch error
    if error code == 59 or error code == Null
        <fallback to existing code for backward compatibility>
    else
        re-raise error

if userInfo["users"]
    <use new updateUser command>
else
    <use new createUser command>

Notes:

1. By default the server will salt and hash the password sent in createUser and updateUser, assuming the password was passed to it in plaintext. This can be controlled using the "digestPassword" option. By default drivers should salt and hash the password client side, passing the password digest to the server instead of the plaintext password. You must pass {digestPassword: false}

   to the server when hashing the password client side.

2. All drivers with an addUser helper must continue to support the 2 and 3 parameter versions of that method. See NOTE below for more details.
3. Delegated authentication is gone in 2.5.x so any tests you have that make use of userSource should be skipped in >= 2.5.3.
4. All users must have roles in 2.5.x. To get the equivalent of a legacy super user for testing you want at least ['readWriteAnyDatabase', 'userAdminAnyDatabase', 'dbAdminAnyDatabase', 'clusterAdmin']
5. To remove all users from a database in 2.5.x use the command {"dropAllUsersFromDatabase": 1}

NOTE - Although createUser requires a "roles" field the addUser helper must continue to support the legacy 2 and 3 parameter forms, i.e.:

db.addUser('username', 'password')
# Read Only User
db.addUser('username', 'password', true)

Drivers will follow the shell implementation specified in SERVER-10794. This requires some new built-in roles, specified in that ticket. Drivers should also warn when these forms are used, as specified in the server ticket.