There are existing tests that do this:

• Create a user on the config server (this creates a cluster-wide user)
• Create a user on the shard server (this creates a shard-specific user)
  the localhost exception is valid for both per cluster and per shard.

if I combine these two roles in a catalog shard, then a user that is created is by default a cluster wide user, so the test should just make sure that we are explicitly testing for this behaviour i,e we cannot create two users on the catalog shard. Because after creating the first user, localhost exception is no longer valid.