WL-3453 Don't allow sysadmin to bypass security checks.

Doing good tests requires too much refactoring so not including that work.
ok no worries