We created a dependency from xwiki-platform-user-api to xwiki-platform-security-authentication-api which is wrong: it should be other way around.