I went to /etc/elasticsearch/shield, did 'vi users' and saw the kibana4-server user inside with a hashed password.
I cannot find 'users' in any other place besides the above location.
Just for tests, I even tried the curl using other users inside 'users' but all resulted the same.