use explicit botuser authentication instead of current_user