using as_admin() rather than a session check when logging in as someone