authad: capabilities depend on userdomain specific config