admin can masquerade as other users.
add log.