By privilege I mean the "Impersonate after authentication privilege" or
"SeImpersonatePrivilege".
This privilege is per default granted to Administrators and Service accounts
(Localsystem, Local Service, Network Service and optionally Aspnet).
If you need to grant this privilege to other accounts, one can use "Local
Security Policy" editor or do so in code (using PInvoke), but before doing
so, beware of the security implications, regular user accounts should not be
able to impersonate.

Willy.

Impersonator, i.e. caller, not target user.

This is so you can shed permissions (as a web app), but not gain them.  One
wouldn't want a local untrusted app being able to execute a dictionary
attack at high speed (or generating random authentication cookies to avoid
the audited call to LogonUser) until successful.

'nix has a similar concept, requiring wheel membership to su as root, even
with the password.