auth: Use only security_token_is_system to determine that a user is SYSTEM