fix: check if user is not a system user or SU before deciding if he is authenticated