Karaf will generate the `startup.properties` automatically. It does not need to be set and will lead to conflicts when updating Karaf.
I will provide a patch for this in a minute.
By default, Karaf also loads the Spring deployer bundle. If this bundle is active, the security configuration files (like mh_default_org.xml) are no longer loaded by our internal Spring Security handler. That's the reason why I've added a customized version of the startup.properties file.