It’s actually similar issue as this:
http://forum.mikrotik.com/t/security-issue-changing-rights-disable-delete-the-users-has-no-effect-on-already-logged-in-users/168574/1
Since there is NO “sessions” in REST (e.g. auth is provided on EACH call) – agree it odd to have the active user hang around.
My question is how long does the “Active User” stick around? REST timeout is in 60 seconds for any operation, so perhaps they get flushed then. My thought is REST may internally cache some creds need, to avoid re-auth with OS – but even then, they should still be cleaned up at some point hopefully before a reboot…