subuser: untested but "complete"