How do I use Conduit in `allow_registration = false` mode?

How do I set up private Conduit server with user accounts only added by administrator?

I set allow_registration = false, but don't see any option of adding users apart from in-protocol registration. Am I supposed to stop Conduit, edit config file to allow_registration=true, start Conduit, register user, stop Conduit again, edit config file to allow_registration=false, start Conduit again and check list-local-users for extra unsolicited registrations each time new user is needed?

By the way, how to I remove users and reset password as admin? Am I supposed to edit the database manually? (if so, is it documented?)