private void checkAdditionalPerms(final UserRef owner) {
        if (!securityContext.isAdmin()) {
            if (owner == null || !Objects.equals(securityContext.getUserRef(), owner)) {
                // logged-in user is not the same as the owner of the key(s) so more perms needed
                if (!securityContext.hasAppPermission(AppPermission.MANAGE_USERS_PERMISSION)) {
                    throw new PermissionException(
                            securityContext.getUserRef(),
                            LogUtil.message("'{}' permission is additionally required to manage " +
                                            "the API keys of other users.", AppPermission.MANAGE_USERS_PERMISSION));
                }
            }
        }
    }
Fetch the verified {@link UserIdentity} for the passed API key.
If the hash of the API key matches one in the database and that key is enabled
and not expired then the {@link UserIdentity} will be returned, else an empty {@link Optional}
is returned.
stroom-security/stroom-security-impl/src/main/java/stroom/security/impl/apikey/ApiKeyService.java