[don't even look] fixes #8439 - DRY up authorization and add "as user" support