set in the target's UserFlags and the impersonator must have UserLevel 200 or above. The user can then log in using the target's name and their own password.