UserAccount::authorized doesn't need to track identities