auth: Allow identities in the UserList