Allow currentUser to be settable (so you can do "login as __" functionality)

Make sure to only expose in safe locations
Add support for single-user permissions