fixes #8439 - DRY up authorization and add "as user" support