consider case of authoritative user being logged in