full_authentication_abilities. This is fine because
we're going to check with can?(..) anyway