adding truly_authorized methods to user so display can weed out quest only access accounts