AuthManager save semantics

[dzhus]

It should be mentioned in the docs that save updates existing
AuthUser if the supplied record contains valid user id (which is the
behaviour of the only available backend). Otherwise it's not clear
at what conditions exactly does it create or update and how
it looks up for the existing user.