Fix for #563

Untested, not sure if it actually fixes the problem, though the
problem is very easy to reproduce.

Basically, if we don't find a box under the effective user, try the
real user.

Things for a reviewer to check:

* resp.send is called in every branch
* this doesn't introduce any obvious security issues