Allow a single user, defined in the configuration file to override all other users defined in the system. I.e. something like

security.authorization.recoveryUser=xyz
security.authorization.recoveryUserPassword=abc
security.authorization.recoveryUserRoles=readAnyDatabase

If these options are set, the users defined in system.users are ignored.