Source:
<code>protected AccountAttributes authenticateAndGetNominalUser(UserType loggedInUserType) { String paramRequestedUserId = request.getParameter(Const.ParamsNames.USER_ID); AccountAttributes account = null; if (!isMasqueradeModeRequested(loggedInUser, paramRequestedUserId)) { account = loggedInUser; boolean isUserLoggedIn = (account.googleId != null); if (isPersistenceIssue() && isHomePage()) { } else if (doesUserNeedRegistration(account) && !loggedInUserType.isAdmin) { if (regkey != null && student != null) { String joinUrl = new Url(student.getRegistrationUrl()) .withParam(Const.ParamsNames.NEXT_URL, requestUrl) .toString(); setRedirectPage(joinUrl); return null; } throw new UnauthorizedAccessException("Unregistered user for a page that needs one"); } else if (isPageNotCourseJoinRelated() && doesRegkeyBelongToUnregisteredStudent() && isUserLoggedIn) { Url redirectUrl = new Url(student.getRegistrationUrl()) .withParam(Const.ParamsNames.STUDENT_NEW_COURSE, student.course) <START> .withParam(Const.ParamsNames.NEXT_URL, requestUrl); <END> setRedirectPage(redirectUrl.toString()); return null; } } else if (loggedInUserType.isAdmin) { account = logic.getAccount(paramRequestedUserId); if (account == null) { regkey = getRegkeyFromRequest(); if (regkey == null) { regkey = "any-non-null-value"; } account = new AccountAttributes(); account.googleId = paramRequestedUserId; } } else { throw new UnauthorizedAccessException("User " + loggedInUserType.id + " is trying to masquerade as " + paramRequestedUserId + " without admin permission."); } return account; }</code><technical_language>Hey, I point out (3) is true user _CAN_ loggedin a (although highly unlikely)</technical_language>

Target:
protected AccountAttributes authenticateAndGetNominalUser(UserType loggedInUserType) { String paramRequestedUserId = request.getParameter(Const.ParamsNames.USER_ID); AccountAttributes account = null; if (!isMasqueradeModeRequested(loggedInUser, paramRequestedUserId)) { account = loggedInUser; boolean isUserLoggedIn = (account.googleId != null); if (isPersistenceIssue() && isHomePage()) { } else if (doesUserNeedRegistration(account) && !loggedInUserType.isAdmin) { if (regkey != null && student != null) { String joinUrl = new Url(student.getRegistrationUrl()) .withParam(Const.ParamsNames.NEXT_URL, requestUrl) .toString(); setRedirectPage(joinUrl); return null; } throw new UnauthorizedAccessException("Unregistered user for a page that needs one"); } else if (isPageNotCourseJoinRelated() && doesRegkeyBelongToUnregisteredStudent() && isUserLoggedIn) { Url redirectUrl = new Url(student.getRegistrationUrl()) .withParam(Const.ParamsNames.NEXT_URL, requestUrl); setRedirectPage(redirectUrl.toString()); return null; } } else if (loggedInUserType.isAdmin) { account = logic.getAccount(paramRequestedUserId); if (account == null) { regkey = getRegkeyFromRequest(); if (regkey == null) { regkey = "any-non-null-value"; } account = new AccountAttributes(); account.googleId = paramRequestedUserId; } } else { throw new UnauthorizedAccessException("User " + loggedInUserType.id + " is trying to masquerade as " + paramRequestedUserId + " without admin permission."); } return account; }