use authenticated_userid instead of unauthenticated_userid in undo so we always get an oid rather than (potentially) a login name