I didn't see this on the forum, but if your "a" user that does not have access rights to change anything, how come you can still read the userid/password from camera's?
If you have chrome and right mouse on the camera image and say inspect, you can find below code:
<img src="/api/proxy?url=http%3A%2F%2Fadmin%3APLAINTEXTPASSWORD%40192.168.1.61%2Fcontrol%2Ffaststream.jpg%3Fstream%3Dfull%3Fts%3D1485011648969" id="FG-39-jpegStream" style="width: 265px; float: left; margin: 20px 0px 0px 55px;">
I don't think that should be there..