Are there any constraints to who is impersonated? If some application gets authenticated by a PSI web server can it impersonate anyone?