diff --git a/sites/all/modules/masquerade/masquerade.module b/sites/all/modules/masquerade/masquerade.module
index 1a05409..56df822 100644
--- a/sites/all/modules/masquerade/masquerade.module
+++ b/sites/all/modules/masquerade/masquerade.module
@@ -663,23 +663,28 @@ function masquerade_autocomplete($string) {
   }
 
   // Other suggestions.
-  if (masquerade_check_role_permission('authenticated user')) {
-    $rids = masquerade_get_not_allowed_roles();
-    $subquery = db_select('users_roles', 'ur');
-    $subquery->addField('ur','uid','uid');
-    $subquery->condition('rid', $rids);
-
-    $query = db_select('users', 'u')
-      ->fields('u', array('name'))
-      ->condition('name', db_like($string) . '%', 'LIKE')
-      ->condition('uid', $user->uid, '!=')
-      ->condition('uid', $subquery, 'NOT IN')
-      ->orderBy('name', 'ASC')
-      ->range(0, 10);
-
-    foreach ($query->execute() as $found_user) {
-      $matches[$found_user->name] = check_plain($found_user->name);
+  $query = db_select('users', 'u')
+    ->fields('u', array('name'))
+    ->condition('name', db_like($string) . '%', 'LIKE')
+    ->condition('uid', $user->uid, '!=')
+    ->orderBy('name', 'ASC')
+    ->range(0, 10);
+
+  if ($rids = masquerade_get_not_allowed_roles()) {
+    $subquery = db_select('users', 'u');
+    $subquery->addField('u','uid','uid');
+    $subquery->leftJoin('users_roles', 'ur', 'ur.uid = u.uid');
+    $or_group = db_or();
+    $or_group->condition('ur.rid', $rids);
+    if (in_array(DRUPAL_AUTHENTICATED_RID, $rids)) {
+      $or_group->isNull('ur.rid');
     }
+    $subquery->condition($or_group);
+    $query->condition('uid', $subquery, 'NOT IN');
+  }
+
+  foreach ($query->execute() as $found_user) {
+    $matches[$found_user->name] = check_plain($found_user->name);
   }
   if (module_exists('devel')) {
     $GLOBALS['devel_shutdown'] = FALSE;
@@ -716,36 +721,41 @@ function masquerade_autocomplete_multiple($string, $add_anonymous = TRUE) {
         }
       }
     }
+
     // Other suggestions.
-    if (masquerade_check_role_permission('authenticated user')) {
-      $rids = masquerade_get_not_allowed_roles();
-      $subquery = db_select('users_roles', 'ur');
-      $subquery->addField('ur','uid','uid');
-      $subquery->condition('rid', $rids);
-
-      $query = db_select('users', 'u')
-        ->fields('u', array('name'))
-        ->condition('name', db_like($string) . '%', 'LIKE')
-        ->condition('uid', $user->uid, '!=')
-        ->condition('uid', $subquery, 'NOT IN')
-        ->orderBy('name', 'ASC')
-        ->range(0, 10);
-
-      foreach ($query->execute() as $found_user) {
-        $matches[$prefix . $found_user->name] = check_plain($found_user->name);
-      }
+    $query = db_select('users', 'u')
+     ->fields('u', array('name'))
+      ->condition('name', db_like($string) . '%', 'LIKE')
+      ->condition('uid', $user->uid, '!=')
+      ->condition('uid', $subquery, 'NOT IN')
+      ->orderBy('name', 'ASC')
+      ->range(0, 10);
 
-      // Remove existing tags.
-      $matches = array_diff($matches, $users_typed);
+    if ($rids = masquerade_get_not_allowed_roles()) {
+      $subquery = db_select('users', 'u');
+      $subquery->addField('u','uid','uid');
+      $subquery->leftJoin('users_roles', 'ur', 'ur.uid = u.uid');
+      $or_group = db_or();
+      $or_group->condition('ur.rid', $rids);
+      if (in_array(DRUPAL_AUTHENTICATED_RID, $rids)) {
+        $or_group->isNull('ur.rid');
+      }
+      $subquery->condition($or_group);
+      $query->condition('uid', $subquery, 'NOT IN');
+    }
+    foreach ($query->execute() as $found_user) {
+      $matches[$prefix . $found_user->name] = check_plain($found_user->name);
+    }
+    // Remove existing tags.
+    $matches = array_diff($matches, $users_typed);
 
-      // @todo Check compatibility for D7.
-      if (module_exists('alt_login')) {
-        $result = db_query_range("SELECT u.alt_login AS alt_login FROM {alt_login} u WHERE LOWER(u.alt_login) LIKE LOWER(:string)", 0, 10, array(
-          ':string' => $last_string . '%',
-        ));
-        foreach ($result as $user) {
-          $matches[$user->alt_login] = check_plain($user->alt_login);
-        }
+    // @todo Check compatibility for D7.
+    if (module_exists('alt_login')) {
+      $result = db_query_range("SELECT u.alt_login AS alt_login FROM {alt_login} u WHERE LOWER(u.alt_login) LIKE LOWER(:string)", 0, 10, array(
+        ':string' => $last_string . '%',
+      ));
+      foreach ($result as $user) {
+        $matches[$user->alt_login] = check_plain($user->alt_login);
       }
     }
   }
@@ -892,17 +902,27 @@ function masquerade_check_role_permission($role) {
  * Checks an array of roles to see if we have access to them.
  *
  * @param $roles
- *  An array of roles to check
+ *  An array of roles to check, keyed by the rid.
  * @return bool
  *  Return FALSE if any role exists that the current user isn't permitted to become.
  *  Return TRUE otherwise.
  */
 function masquerade_check_roles($roles = array()) {
-  foreach ($roles as $role) {
-    if (!masquerade_check_role_permission($role)) {
-      return FALSE;
+  foreach ($roles as $rid => $role) {
+    if ($rid != DRUPAL_AUTHENTICATED_RID) {
+      if (!masquerade_check_role_permission($role)) {
+        return FALSE;
+      }
     }
   }
+
+  // Handle the case where the target user has just the authenticated user role.
+  // If it is the target user's only role, only then we ned to check if the
+  // current user has rights to switch to the target user.
+  if (count($roles) == 1 && key($roles) == DRUPAL_AUTHENTICATED_RID
+        && !masquerade_check_role_permission('authenticated user')) {
+    return FALSE;
+  }
   return TRUE;
 }
 
@@ -948,7 +968,8 @@ function masquerade_has_any_masquerade_permission() {
 /**
  * Get roles the current user is allowed to masquerade to.
  *
- * @return void
+ * @return array
+ *   An array of rids that the user is not alowed to masquerade as.
  **/
 function masquerade_get_not_allowed_roles() {
   $rids = array();