masquerade as other users via `x-masquerade-as` header middleware