Implement RFC2120 only provide authzid if trying to act as another user
Only attempt to get user if this.actAs is set