Check user permissions before allowing them to become someone else