It could be persist(), correct. I'm always use merge() for both insert/update, its a habit
As for transaction – its inactive for my primary use case (I have the only use case actually – a simple sign-in web flow).
Also, as far as I remember, even if transaction were active it will be rolled back at the end of request if not explicitly committed. Which means there should be @CommitAfter annotation somewhere or some other commit-logic which you normally won't have during simple login... but it may be present for some complex scenarios, I guess.