Add can_withdraw(user) method to AuthenticatedUser

For ticket #2162