only a live member of the org who holds no staff role, and not the caller, can be signed in as
impersonate_user
