user: harden auth_active?/1, superuser?/1, visible_for?/1