Server complains that user needs to login even if it specified the right username and password for the database. Offending code in createIndex (@restore.cpp):
BSONObj err = conn().getLastErrorDetailed(false, false, _w);
The problem with the code above is getLastErrorDetailed would always run the command against the admin database, and if the user specified a database (through the -d parameter) other than admin, then this will not work.