Split from bug 29906: list=users&usprop=rights shows rights the user doesn't have
Steps to reproduce:
- Look into [[Special:Log/newusers]] to get the name of a new user.
In this example we get rights shown like move and autoconfirmed which a new user definitely doesn't have. The groups are correct and I didn't find any edit to a semiprotected page by a new user though I can see autoconfirmed rights for all users in every project, so it seems like only the API shows nonsense.