use client.site_id if site id is not passed to users.find_by; correctly run-as user