core: allow admins to impersonate other users