Chris Withers writes:

I do have memories that REQUEST.AUTHENTICATED_USER has been deprecated. In which, case, how should you get hold of the current user's object and can this be made to work in a testing environment? Your company is hosting these great searchable list archives? They help memory very much.

Your question has been answered some days ago... "getSecurityUser" documented in "AccessControl.DTML" Dieter