code: func (c *SessionContext) GetUserClient(site reversetunnel.RemoteSite) (auth.ClientI, error) {
  	// get the name of the current cluster
  	clt, err := c.GetClient()
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  	cn, err := clt.GetClusterName()
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	// if we're trying to access the local cluster, pass back the local client.
  	if cn.GetClusterName() == site.GetName() {
  		return clt, nil
  	}
  
  	// look to see if we already have a connection to this cluster
  	remoteClt, ok := c.getRemoteClient(site.GetName())
  	if !ok {
  		rClt, rConn, err := c.newRemoteClient(site)
  		if err != nil {
  			return nil, trace.Wrap(err)
  		}
  
  		// add a closer for the underlying connection
  		if rConn != nil {
  			c.AddClosers(rConn)
  		}
  
  		// we'll save the remote client in our session context so we don't have to
  		// build a new connection next time. all remote clients will be closed when
  		// the session context is closed.
  		c.addRemoteClient(site.GetName(), rClt)
  
  		return rClt, nil
  	}
  
  	return remoteClt, nil
  }
docs: // GetUserClient will return an auth.ClientI with the role of the user at
  // the requested site. If the site is local a client with the users local role
  // is returned. If the site is remote a client with the users remote role is
  // returned.