When the client makes an authenticated request, the server must run that request as that user; currently, all API requests are still run as the root user, regardless of the specific user that has been authenticated.