Right now we have special handling of system namespaces in multiple places. system.profile and system.users are handled by _modifyPrivilegeForSpecialNamespaces in the AuthorizationManager, but system.indexes is handled specially elsewhere in code.
We'd like to consolidate the special casing of system indexes to all be within the AuthorizationManager. This can't happen right now because the checkAuth* methods only take a namespace, they don't take the object being inserted, updated, queried, etc.