diff --git a/internal/web/api_v1_test.go b/internal/web/api_v1_test.go
index 39a2267..4e689b4 100644
--- a/internal/web/api_v1_test.go
+++ b/internal/web/api_v1_test.go
@@ -500,11 +500,13 @@ func TestBearerActorRevalidation(t *testing.T) {
 	}
 
 	tests := []struct {
-		name          string
-		mutate        func(t *testing.T, env *testAPIEnv)
-		method        string
-		path          string
-		body          any
+		name   string
+		mutate func(t *testing.T, env *testAPIEnv)
+		method string
+		path   string
+		body   any
+		// loadOtherCID: when path is /user/load and body is nil, load observer instead of self.
+		loadOtherCID  bool
 		wantStatus    int
 		wantErrSubstr string
 	}{
@@ -571,9 +573,9 @@ func TestBearerActorRevalidation(t *testing.T) {
 			mutate: func(t *testing.T, env *testAPIEnv) {
 				setRating(t, env, env.admin.CID, int(protocol.NetworkRatingObserver))
 			},
-			method: http.MethodPost,
-			path:   "/api/v1/user/load",
-			// body set to observer CID in loop
+			method:        http.MethodPost,
+			path:          "/api/v1/user/load",
+			loadOtherCID:  true,
 			wantStatus:    http.StatusForbidden,
 			wantErrSubstr: "forbidden",
 		},
@@ -590,9 +592,8 @@ func TestBearerActorRevalidation(t *testing.T) {
 
 			body := tt.body
 			if tt.path == "/api/v1/user/load" && body == nil {
-				// Default: load self; demoted-cannot-load-other overrides to other CID.
 				cid := env.admin.CID
-				if tt.name == "demoted_admin_cannot_load_other" {
+				if tt.loadOtherCID {
 					cid = env.observer.CID
 				}
 				body = map[string]any{"cid": cid}
diff --git a/internal/web/auth.go b/internal/web/auth.go
index 063df66..6899331 100644
--- a/internal/web/auth.go
+++ b/internal/web/auth.go
@@ -403,7 +403,8 @@ func (s *Server) requireSessionHTML(c *gin.Context) {
 	c.Next()
 }
 
-// getDBUser returns the *db.User stashed by requireSessionHTML / trySessionAuth.
+// getDBUser returns the *db.User stashed by requireSessionHTML, trySessionAuth,
+// or revalidateBearerActor (dual-accept Bearer resource path).
 func getDBUser(c *gin.Context) *db.User {
 	val, exists := c.Get(dbUserContextKey)
 	if !exists {