def acl_allowed(req, username):
    """
    Helper for checking ACLs for a given username when username is not included in params.
    Allow if the username matches the session user, if an app is using an API key and is
    allowed to authenticate users, or if the user is an admin.
    """
    return req.context['username'] == username or req.context.get('app', {}
        ).get('allow_authenticating_users') or req.context['is_admin']
