UserStorage::impersonate() does not need to check if user is a superuser