fixes impersonate() to explicitly use authenticated resource when checking permissions and to check for null argument; adds test class