(bug 38633) Don't block non-existent users via the API