turns out we didn't need to check all those user caps. "subscriber" would do.