Fix loop limit (system.stats.total_users != system.lastuser)

When looping to highest user number, use system.lastuser, not
system.stats.total_users.

This explains why not all userbases would be affected by the just-fixed
issue in js_user.c. If the total_users happens to equal lastuser, then
you would have hit the issue in js_user.c. If you had at least one
deleted or inactive user account, then system.stats.total_users would
be less than system.lastuser and your system would *not* have triggered
that bug.