Rename the fallback-users entry to wildcard-user, and only
allow a single fallback user.  This is missing the HTTP API.