Create Merle account on first CAS login only
It would probably be up to the cas-bridge
to create the account on the fly, before redirecting to Merle. It could also deprecate the shared secret used to HMAC the user ID, since the bridge would be the one to create the account and set the auth value.