+partial_auth, +GRANT
sess. val in sys-application: usrPhoto, usrName