In the current distribution, at startup, the PicketLinkLoadUsers class will create a user (John) with admin role. This is very useful for tests purposes but it is a bit dangerous, IMO, to ship this class with the distribution. If the developer is not aware of this, there will be by default an user registered with admin rights.
If we want to keep it here, we should at least document it and show how to remove this user.