argumnets for auth.determine_user_rights has changed. Pass the callers hrn instead...