_is_subset_of handles 'authenticated' correctly