We noticed and fixed a bug where a pre-parse auth check was sending a sub-query with a DBDirectClient. We didn't want that sub-query to initialize the ifrContext with no flags, and we worked around this. But will.buerger@mongodb.com pointed out during review that it raises a question of whether/how this part of the op should see an ifrContext.

We should investigate moving the initialization as early as we can, though I wonder if this auth check will always happen first since it's trying to see if there is any user authorized to do anything, so we don't want to do anything very expensive before that. Worth looking into if we can do it cheaply enough.