I've moved this over before the run_lock so that someone setting this in the config will get a better error message when non-admins run chef-client.