Auth logic stuff. partial eager loading of access profile