only admin may impersonate other users in webui