Using non-admin auth collection in access control.

What's the way to go about using a non-admin auth collection for access control on another collection? Since the

field in the request is null.

^ignore, wasn't aware csrf was needed