Previously, users could impersonate without being logged in, meaning that they could log in without a password to any user's account.

This is now no longer the case, HOWEVER route guards should still be implemented to restrict impersonation to administrators.