SecurityService API: updateUser not accessible before login?

Hi,

We are using the BIP web services API extensively. This question relates to SecurityService - we suspect this may be a bug but would like verification if possible before creating a service request. BIP version:11.1.1.7.141014 in use.

Error:

<faultcode>soapenv:Server.userException</faultcode>

<faultstring>java.lang.SecurityException: Security violation: /~createTest; art does not have permission to create this folder.</faultstring>

This error happens if we have created a new user called createTest using the SecurityService -> createUser method (creator: art is an administrator user), followed by a updateUser (update user password) call, if the user has NOT logged onto BIP prior to making updateUser call. This is cumbersome because if the user has never logged on and we call updateUser, the only way to ever access this user via web-services is to login with administrator user, change the password of the user manually in the users view, and then issue another updateUser call.