Impersonating an admin who impersonates yourself leads to a non-audited authenticated session

Procedure:

  1. Have two or more admin users (Alice and Bob)
  2. Log in as Alice (yourself)
  3. Impersonate Bob
  4. In that impersonation sessions, impersonate Alice
  5. Stop impersonation
  6. See that you are now logged in as Bob
  7. However, you really are still Alice, but GitLab's interface no longer indicates that you are impersonating Bob, rather you are Bob.