Steps to reproduce

• configure restrictUserOperationLogToAuthenticatedUsers to false in process engine configuration
• have a REST-API endpoint without authentication
• for a process instance with historical variables, delete one historical entry via unauthenticated REST call
• click on the 'User Operations' tab in the process instance history - it loads forever

AT

• The User Operations Tab loads
• operations with userID null are shown with empty 'User' column

Hints
Differentiation:

1. if the entry with null user is the only entry for the process instance
   1. the follow-up request on "/user" is with "idIn="
   2. the Chrome web console shows no error
2. if the entry with null user is one of the entries for the process instance
   1. the follow-up request on "/user" is with "idIn=,demo"
   2. the Chrome web console shows:

TypeError: Cannot read property 'firstName' of undefined
    at plugin.js?bust=7.11.0-SNAPSHOT-1549442749865:12
    at Array.map (<anonymous>)
    at plugin.js?bust=7.11.0-SNAPSHOT-1549442749865:12
    at processQueue (deps.js?bust=7.11.0-SNAPSHOT-1549442749865:25907)
    at deps.js?bust=7.11.0-SNAPSHOT-1549442749865:25955
    at Scope.$digest (deps.js?bust=7.11.0-SNAPSHOT-1549442749865:27068)
    at deps.js?bust=7.11.0-SNAPSHOT-1549442749865:27388
    at TaskTracker.completeTask (deps.js?bust=7.11.0-SNAPSHOT-1549442749865:29187)
    at deps.js?bust=7.11.0-SNAPSHOT-1549442749865:14783 "Possibly unhandled rejection: {}"