Several places in the mongod command handling check for authorization in addition to the checks for the command itself. Some of these checks seem unnecessary, in particular:

1. Checking for internal auth in initializeOperationSessionInfo()
   1. This is only needed if internal session options are used, but is checked every time regardless.
2. Checking for internal auth if an operation key was included in the request
   1. Operation keys are used to kill operations started by establishCursors (e.g. a find from a mongos), and can only be killed using the _killOperations command, which already requires internal auth, so checking when adding the keys seems unnecessary.
3. If a client includes WriteBlockBypass metadata
   1. We require internal auth whether setting WriteBlockBypass to true or false, and mongos always sends this value, usually to false, so every request from a mongos has the extra check. It seems more reasonable to only check if trying to set WriteBlockBypass to true.
4. When gossiping out $clusterTime when sending a request to another cluster node
   1. Cluster nodes always authenticate as __system and this user can always advance cluster time, so there's no need to check auth when gossiping out as part of egress commands.
5. When gossiping out $clusterTime when sending a response back to a client that already was authorized to gossip $clusterTime in (same code as above)
   1. Generally clients will include $clusterTime in their requests to a server, which will be rejected with an error if the client isn't authorized to advance the logical clock. At the end of the request, we check again if that client is authorized to advance the clock to decide if they should receive $clusterTime, which checks the same privileges on the same operation context. If we can assume an operation context's authorization won't change over its lifetime (need to confirm this), then we can skip the second check.