check for superuser now safe (if undefined)