userman: convert to global `log`
userman mwPutWaitEvents: check `req.session.user` too
userman: return 'no_remote_access' error