%{SQL-User-Name} parsing in authorize section - bug?