We could potentially just put this resolution of SPARK_USER inside runAsUser (calling it maybe runAsSparkUser), to avoid duplication of this logic and the weird SPARK_UNKNOWN_USER value.