Implicitly trust Personas which are marked as being the user

We assume that the backend is in complete control of its user accounts, so
we can fully trust Personas which have Persona.is_user == true.
Helps: bgo#627402