A mongod started with --auth allows the first user to be created via the localhost exception, and then all further operations require auth. In the past, after all users were dropped, mongod returned to this initial state. Now, it seems to reject the createUser command after all users are dropped:

not authorized on admin to execute command { createUser: "user", pwd: "xxx", digestPassword: false, roles: [ "root" ], $db: "admin" }

I'm connecting to 127.0.0.1. I haven't investigated to see when this behavior change happened.